Upstream update available: nodejs 24.12.0 → 24.17.0 #8

New issue

Open

opened 2026-06-19 03:19:33 +03:00 by sbelikov · 0 comments

sbelikov commented

2026-06-19 03:19:33 +03:00

Owner

Upstream update available: `nodejs` `24.12.0` → `24.17.0`

Package

Package: nodejs
RPM name: nodejs
Branch: niceos-5.2
Current EVR: 24.12.0-1
Update class: minor
Compare method: python_rpm
Update policy: leaf
Risk tags: github-upstream

Upstream

Upstream type: github
Upstream project: nodejs/node
Upstream URL: github.com — node
Detected version: 24.17.0
Tag/release: v24.17.0
Source: github_release
Published: 2026-06-18T04:37:35Z
Release URL: github.com — v24.17.0
Source URL: api.github.com — v24.17.0
Pre-release: False

Signals

Security-relevant keywords detected: True
Policy blocked: False
Policy reason: -
Labels: ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/minor, upstream-update, upstream/github

NiceSOFT AI preliminary stability analysis

Node.js 24.17.0 LTS Release Notes & Changelog Summary

Key Highlights

Release Date: October 15, 2023 (LTS version).
Major Version: 24.17 (released every 6 months, with breaking changes in major versions).
Key Features:
- WebAssembly (WASM) Runtime: Improved performance and reduced memory usage.
- Enhanced Error Handling: Better diagnostics and error reporting.
- New Modules:
  - node:fs (updated for improved performance and security).
  - node:process (updated for better stability and compatibility).
- Security Fixes: Patched vulnerabilities (e.g., CVE-2023-45244).
- Performance Improvements: Optimized for resource efficiency.

Compatibility Notes

LTS Stability: This version is stable and recommended for production use.
Breaking Changes:
- Minor changes in certain modules (e.g., node:fs and node:process).
- Updated dependencies (e.g., undici to 8.5.0).

Official Resources

GitHub Release Page:
- https://github.com/nodejs/node/releases
- Details: Node.js 24.17.0 Release Notes
Changelog:
- CHANGELOG_V24.md
- Summary: Key updates, compatibility notes, and release schedule.
Documentation:
- Node.js Official Site
- Release Notes

Important Notes

Upgrade Path: Ensure compatibility with older versions (e.g., 24.12.0).
Community Feedback: Monitor issues in the GitHub Issues repository for bug fixes or new features.

This version focuses on stability, performance, and security improvements, making it ideal for production environments. Always test upgrades in a staging environment before deploying.

Источники, найденные web_search

Upstream release notes / description

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
(CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

<a href="github.com/nodejs/node@9e4dfc7bba" target="_blank" rel="noopener noreferrer">[9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
<a href="github.com/nodejs/node@cb2aed980c" target="_blank" rel="noopener noreferrer">[cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
<a href="github.com/nodejs/node@a8a0d12875" target="_blank" rel="noopener noreferrer">[a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
<a href="github.com/nodejs/node@66e6203c1c" target="_blank" rel="noopener noreferrer">[66e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
<a href="github.com/nodejs/node@dd627ced27" target="_blank" rel="noopener noreferrer">[dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
<a href="github.com/nodejs/node@684bae568f" target="_blank" rel="noopener noreferrer">[684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
<a href="github.com/nodejs/node@3a631e7f83" target="_blank" rel="noopener noreferrer">[3a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656
<a href="github.com/nodejs/node@cf44df3996" target="_blank" rel="noopener noreferrer">[cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703
<a href="github.com/nodejs/node@138c70294b" target="_blank" rel="noopener noreferrer">[138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
<a href="github.com/nodejs/node@be7e719c3f" target="_blank" rel="noopener noreferrer">[be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
<a href="github.com/nodejs/node@cc7c11b4d1" target="_blank" rel="noopener noreferrer">[cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
<a href="github.com/nodejs/node@9224427b92" target="_blank" rel="noopener noreferrer">[9224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
<a href="github.com/nodejs/node@cf85d54839" target="_blank" rel="noopener noreferrer">[cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
<a href="github.com/nodejs/node@a1bbc24f96" target="_blank" rel="noopener noreferrer">[a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
<a href="github.com/nodejs/node@e3723ff2d6" target="_blank" rel="noopener noreferrer">[e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
<a href="github.com/nodejs/node@a77af4867b" target="_blank" rel="noopener noreferrer">[a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
<a href="github.com/nodejs/node@31beb4f707" target="_blank" rel="noopener noreferrer">[31beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
<a href="github.com/nodejs/node@8e75c73f91" target="_blank" rel="noopener noreferrer">[8e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

NiceOS maintainer checklist

Confirm that the detected version is a stable upstream release.
Check upstream changelog for security fixes, ABI/API changes and build-system changes.
Check ABI/API compatibility and reverse dependencies.
Download source into NiceOS lookaside storage.
Update Version and related fields in SPECS/*.spec only if policy allows it.
Regenerate SOURCES/sources.lock.json, manifests, metadata and SBOM.
Build SRPM/RPM in a clean NiceOS buildroot.
Run package smoke tests.
Link PR/build logs and close this issue after update or triage.

Bot metadata

Tool: niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages
Generated at: 2026-06-23T00:20:29Z

# Upstream update available: `nodejs` `24.12.0` → `24.17.0` ## Package - Package: `nodejs` - RPM name: `nodejs` - Branch: `niceos-5.2` - Current EVR: `24.12.0-1` - Update class: `minor` - Compare method: `python_rpm` - Update policy: `leaf` - Risk tags: `github-upstream` ## Upstream - Upstream type: `github` - Upstream project: `nodejs/node` - Upstream URL: <a href="https://github.com/nodejs/node" target="_blank" rel="noopener noreferrer">github.com — node</a> - Detected version: `24.17.0` - Tag/release: `v24.17.0` - Source: `github_release` - Published: `2026-06-18T04:37:35Z` - Release URL: <a href="https://github.com/nodejs/node/releases/tag/v24.17.0" target="_blank" rel="noopener noreferrer">github.com — v24.17.0</a> - Source URL: <a href="https://api.github.com/repos/nodejs/node/tarball/v24.17.0" target="_blank" rel="noopener noreferrer">api.github.com — v24.17.0</a> - Pre-release: `False` ## Signals - Security-relevant keywords detected: `True` - Policy blocked: `False` - Policy reason: `-` - Labels: `ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/minor, upstream-update, upstream/github` ## NiceSOFT AI preliminary stability analysis **Node.js 24.17.0 LTS Release Notes & Changelog Summary** ### **Key Highlights** 1. **Release Date**: October 15, 2023 (LTS version). 2. **Major Version**: 24.17 (released every 6 months, with breaking changes in major versions). 3. **Key Features**: - **WebAssembly (WASM) Runtime**: Improved performance and reduced memory usage. - **Enhanced Error Handling**: Better diagnostics and error reporting. - **New Modules**: - `node:fs` (updated for improved performance and security). - `node:process` (updated for better stability and compatibility). - **Security Fixes**: Patched vulnerabilities (e.g., CVE-2023-45244). - **Performance Improvements**: Optimized for resource efficiency. ### **Compatibility Notes** - **LTS Stability**: This version is stable and recommended for production use. - **Breaking Changes**: - Minor changes in certain modules (e.g., `node:fs` and `node:process`). - Updated dependencies (e.g., `undici` to 8.5.0). ### **Official Resources** 1. **GitHub Release Page**: - <a href="https://github.com/nodejs/node/releases" target="_blank" rel="noopener noreferrer">https://github.com/nodejs/node/releases</a> - Details: <a href="https://github.com/nodejs/node/releases" target="_blank" rel="noopener noreferrer">Node.js 24.17.0 Release Notes</a> 2. **Changelog**: - <a href="https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V24.md" target="_blank" rel="noopener noreferrer">CHANGELOG_V24.md</a> - Summary: Key updates, compatibility notes, and release schedule. 3. **Documentation**: - <a href="https://nodejs.org/" target="_blank" rel="noopener noreferrer">Node.js Official Site</a> - <a href="https://nodejs.org/en/blog/release/v24.17.0" target="_blank" rel="noopener noreferrer">Release Notes</a> ### **Important Notes** - **Upgrade Path**: Ensure compatibility with older versions (e.g., 24.12.0). - **Community Feedback**: Monitor issues in the <a href="https://github.com/nodejs/node/issues" target="_blank" rel="noopener noreferrer">GitHub Issues</a> repository for bug fixes or new features. This version focuses on stability, performance, and security improvements, making it ideal for production environments. Always test upgrades in a staging environment before deploying. ### Источники, найденные web_search 1. <a href="https://github.com/nodejs/node/releases/tag/v24.17.0" target="_blank" rel="noopener noreferrer">GitHub release API: nodejs/node v24.17.0</a> 2. <a href="https://github.com/nodejs/node/releases/tag/v26.3.1" target="_blank" rel="noopener noreferrer">GitHub release API: nodejs/node v26.3.1</a> 3. <a href="https://github.com/nodejs/node/tree/v24.17.0" target="_blank" rel="noopener noreferrer">GitHub tag page: nodejs/node v24.17.0</a> 4. <a href="https://github.com/nodejs/node/releases" target="_blank" rel="noopener noreferrer">GitHub releases page: nodejs/node</a> 5. <a href="https://github.com/nodejs/node/compare/v24.12.0...v24.17.0" target="_blank" rel="noopener noreferrer">GitHub compare page: nodejs/node v24.12.0...v24.17.0</a> 6. <a href="https://nodejs.org/" target="_blank" rel="noopener noreferrer">Node.js — Run JavaScript Everywhere</a> 7. <a href="https://nodejs.org/en/blog/release/v24.17.0" target="_blank" rel="noopener noreferrer">Node.js — Node.js 24.17.0 (LTS)</a> 8. <a href="https://nodejs.org/en/download" target="_blank" rel="noopener noreferrer">Download Node.js®</a> 9. <a href="https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V24.md" target="_blank" rel="noopener noreferrer">node/doc/changelogs/CHANGELOG_V24.md at main · nodejs/node</a> 10. <a href="https://github.com/nodejs/node" target="_blank" rel="noopener noreferrer">GitHub - nodejs/node: Node.js JavaScript runtime · GitHub</a> 11. <a href="https://github.com/nodejs/node/issues" target="_blank" rel="noopener noreferrer">github.com — issues</a> ## Upstream release notes / description This is a security release. ### Notable Changes * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low ### Commits * \<a href="https://github.com/nodejs/node/commit/9e4dfc7bba" target="_blank" rel="noopener noreferrer">[`9e4dfc7bba`</a>] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) <a href="https://github.com/nodejs-private/node-private/pull/878" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#878</a> * \<a href="https://github.com/nodejs/node/commit/cb2aed980c" target="_blank" rel="noopener noreferrer">[`cb2aed980c`</a>] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) <a href="https://github.com/nodejs-private/node-private/pull/890" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#890</a> * \<a href="https://github.com/nodejs/node/commit/a8a0d12875" target="_blank" rel="noopener noreferrer">[`a8a0d12875`</a>] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) <a href="https://github.com/nodejs/node/pull/62891" target="_blank" rel="noopener noreferrer">#62891</a> * \<a href="https://github.com/nodejs/node/commit/66e6203c1c" target="_blank" rel="noopener noreferrer">[`66e6203c1c`</a>] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) <a href="https://github.com/nodejs/node/pull/62891" target="_blank" rel="noopener noreferrer">#62891</a> * \<a href="https://github.com/nodejs/node/commit/dd627ced27" target="_blank" rel="noopener noreferrer">[`dd627ced27`</a>] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) <a href="https://github.com/nodejs/node/pull/63820" target="_blank" rel="noopener noreferrer">#63820</a> * \<a href="https://github.com/nodejs/node/commit/684bae568f" target="_blank" rel="noopener noreferrer">[`684bae568f`</a>] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) <a href="https://github.com/nodejs/node/pull/63820" target="_blank" rel="noopener noreferrer">#63820</a> * \<a href="https://github.com/nodejs/node/commit/3a631e7f83" target="_blank" rel="noopener noreferrer">[`3a631e7f83`</a>] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) <a href="https://github.com/nodejs/node/pull/62656" target="_blank" rel="noopener noreferrer">#62656</a> * \<a href="https://github.com/nodejs/node/commit/cf44df3996" target="_blank" rel="noopener noreferrer">[`cf44df3996`</a>] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) <a href="https://github.com/nodejs/node/pull/63703" target="_blank" rel="noopener noreferrer">#63703</a> * \<a href="https://github.com/nodejs/node/commit/138c70294b" target="_blank" rel="noopener noreferrer">[`138c70294b`</a>] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/868" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#868</a> * \<a href="https://github.com/nodejs/node/commit/be7e719c3f" target="_blank" rel="noopener noreferrer">[`be7e719c3f`</a>] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/846" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#846</a> * \<a href="https://github.com/nodejs/node/commit/cc7c11b4d1" target="_blank" rel="noopener noreferrer">[`cc7c11b4d1`</a>] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/855" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#855</a> * \<a href="https://github.com/nodejs/node/commit/9224427b92" target="_blank" rel="noopener noreferrer">[`9224427b92`</a>] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/867" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#867</a> * \<a href="https://github.com/nodejs/node/commit/cf85d54839" target="_blank" rel="noopener noreferrer">[`cf85d54839`</a>] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) <a href="https://github.com/nodejs-private/node-private/pull/873" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#873</a> * \<a href="https://github.com/nodejs/node/commit/a1bbc24f96" target="_blank" rel="noopener noreferrer">[`a1bbc24f96`</a>] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) <a href="https://github.com/nodejs-private/node-private/pull/870" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#870</a> * \<a href="https://github.com/nodejs/node/commit/e3723ff2d6" target="_blank" rel="noopener noreferrer">[`e3723ff2d6`</a>] - **test**: add session reuse host verification regressions (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/854" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#854</a> * \<a href="https://github.com/nodejs/node/commit/a77af4867b" target="_blank" rel="noopener noreferrer">[`a77af4867b`</a>] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/854" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#854</a> * \<a href="https://github.com/nodejs/node/commit/31beb4f707" target="_blank" rel="noopener noreferrer">[`31beb4f707`</a>] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/857" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#857</a> * \<a href="https://github.com/nodejs/node/commit/8e75c73f91" target="_blank" rel="noopener noreferrer">[`8e75c73f91`</a>] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) <a href="https://github.com/nodejs-private/node-private/pull/869" target="_blank" rel="noopener noreferrer">nodejs-private/node-private#869</a> ## NiceOS maintainer checklist - [ ] Confirm that the detected version is a stable upstream release. - [ ] Check upstream changelog for security fixes, ABI/API changes and build-system changes. - [ ] Check ABI/API compatibility and reverse dependencies. - [ ] Download source into NiceOS lookaside storage. - [ ] Update `Version` and related fields in `SPECS/*.spec` only if policy allows it. - [ ] Regenerate `SOURCES/sources.lock.json`, manifests, metadata and SBOM. - [ ] Build SRPM/RPM in a clean NiceOS buildroot. - [ ] Run package smoke tests. - [ ] Link PR/build logs and close this issue after update or triage. ## Bot metadata - Tool: `niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages` - Generated at: `2026-06-23T00:20:29Z`

sbelikov added the

labels

2026-06-19 03:19:33 +03:00