Skip to content

chore: bump up all dependencies to v26 - #2514

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@types/node (source) ^24.7.1 → ^26.0.0 age confidence devDependencies major
node (source) 24.22.1 → 26.13.0 age confidence major

Release Notes

nodejs/node (node)

v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @​richardlau

Compare Source

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

v26.12.1: 2026-10-21, Version 26.12.1 (Current), @​aduh95 prepared by @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
  • (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
  • (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
  • (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
  • (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
  • (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
  • (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
  • (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
  • (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
  • (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
  • deps: V8: backport 93cd21e (Joyee Cheung)
  • crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
  • tls: reject chains containing blocked public keys (Ulises Gascon)
  • deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
  • tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
  • crypto: harden X.509 conversion and formatting (Filip Skokan)
Commits

v26.12.0: 2026-10-14, Version 26.12.0 (Current), @​richardlau

Compare Source

Notable Changes
  • [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #​66533
  • [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #​66335
Commits

v26.11.1: 2026-10-07, Version 26.11.1 (Current), @​aduh95

Compare Source

Commits
  • [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
  • [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
  • [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

v26.11.0: 2026-10-07, Version 26.11.0 (Current), @​aduh95

Compare Source

Notable Changes
  • [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #​66298
  • [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #​66064
  • [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #​62045
  • [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #​63737
  • [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #​66334
  • [7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #​65619
  • [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #​66115
  • [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #​66114
  • [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #​66099
  • [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #​66099
  • [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #​66098
  • [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #​66213
  • [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #​65988
  • [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #​66138
  • [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #​65737
  • [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #​66067
Commits

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
milkdown-storybook Ready Ready Preview Oct 31, 2026 1:53am UTC

Request Review

@changeset-bot

changeset-bot Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5bbccc1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

@milkdown/components

npm i https://pkg.pr.new/@milkdown/components@2514

@milkdown/core

npm i https://pkg.pr.new/@milkdown/core@2514

@milkdown/crepe

npm i https://pkg.pr.new/@milkdown/crepe@2514

@milkdown/ctx

npm i https://pkg.pr.new/@milkdown/ctx@2514

@milkdown/exception

npm i https://pkg.pr.new/@milkdown/exception@2514

@milkdown/kit

npm i https://pkg.pr.new/@milkdown/kit@2514

@milkdown/prose

npm i https://pkg.pr.new/@milkdown/prose@2514

@milkdown/transformer

npm i https://pkg.pr.new/@milkdown/transformer@2514

@milkdown/utils

npm i https://pkg.pr.new/@milkdown/utils@2514

@milkdown/react

npm i https://pkg.pr.new/@milkdown/react@2514

@milkdown/vue

npm i https://pkg.pr.new/@milkdown/vue@2514

@milkdown/plugin-automd

npm i https://pkg.pr.new/@milkdown/plugin-automd@2514

@milkdown/plugin-block

npm i https://pkg.pr.new/@milkdown/plugin-block@2514

@milkdown/plugin-clipboard

npm i https://pkg.pr.new/@milkdown/plugin-clipboard@2514

@milkdown/plugin-collab

npm i https://pkg.pr.new/@milkdown/plugin-collab@2514

@milkdown/plugin-cursor

npm i https://pkg.pr.new/@milkdown/plugin-cursor@2514

@milkdown/plugin-diff

npm i https://pkg.pr.new/@milkdown/plugin-diff@2514

@milkdown/plugin-emoji

npm i https://pkg.pr.new/@milkdown/plugin-emoji@2514

@milkdown/plugin-highlight

npm i https://pkg.pr.new/@milkdown/plugin-highlight@2514

@milkdown/plugin-history

npm i https://pkg.pr.new/@milkdown/plugin-history@2514

@milkdown/plugin-indent

npm i https://pkg.pr.new/@milkdown/plugin-indent@2514

@milkdown/plugin-listener

npm i https://pkg.pr.new/@milkdown/plugin-listener@2514

@milkdown/plugin-prism

npm i https://pkg.pr.new/@milkdown/plugin-prism@2514

@milkdown/plugin-slash

npm i https://pkg.pr.new/@milkdown/plugin-slash@2514

@milkdown/plugin-streaming

npm i https://pkg.pr.new/@milkdown/plugin-streaming@2514

@milkdown/plugin-tooltip

npm i https://pkg.pr.new/@milkdown/plugin-tooltip@2514

@milkdown/plugin-trailing

npm i https://pkg.pr.new/@milkdown/plugin-trailing@2514

@milkdown/plugin-upload

npm i https://pkg.pr.new/@milkdown/plugin-upload@2514

@milkdown/preset-commonmark

npm i https://pkg.pr.new/@milkdown/preset-commonmark@2514

@milkdown/preset-gfm

npm i https://pkg.pr.new/@milkdown/preset-gfm@2514

@milkdown/theme-nord

npm i https://pkg.pr.new/@milkdown/theme-nord@2514

commit: 5bbccc1

@renovate renovate Bot changed the title chore: bump up @types/node version to v26 chore: bump up all dependencies to v26 Oct 31, 2026

This branch was successfully deployed

1 active deployment
Preview — 5bbccc17 Deployed Oct 31, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants