Repository navigation
Update node to 26.12.1 and node-lts to 24.22.1 (security; upstream eMudhra fix, drop carried patches) - #968
Conversation
…d patches) Both are upstream security releases and both carry the CVE-2026-111943 fixes (nodejs/node#66871 SPKI blocklist, #66877 NSS 3.131.1 roots), so the backports from #946 are dropped; node 26.12.1 also handles the LIEF 1.x Section API itself, so its LIEF patch goes too, and with it the `patch` build dep. build.sh now fails closed if a future version regresses either fix. node moves to nodejs.org's release tarball (same as node-lts), sha verified against SHASUMS256.txt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the Node.js version updates and the removal of carried security patches. It accurately summarizes the main changes. |
| Linked Issues check | |
Issue [#1016] requires Node 26.x and 24.x LTS releases that contain both CVE-2026-111943 fixes, deletion of both carried patches, and protection against double application. The PR sets versions to 26.… |
| Out of Scope Changes check | |
The changes stay within Issue [#1016]. The node source-tarball correction and LIEF patch removal support the required version bump and the new upstream source. The fail-closed build guards and standal… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2… |
Full details: Linked Issues check
-
Explanation
Issue [
#1016] requires Node 26.x and 24.x LTS releases that contain both CVE-2026-111943 fixes, deletion of both carried patches, and protection against double application. The PR sets versions to 26.12.1 and 24.22.1, uses verified nodejs.org release checksums, deletes both patch files for each package, removes the patch dependencies, and removes patch application commands. Both build scripts fail when the upstream SPKI blocklist or certificate callback is absent. The package tests check removal of all three compromised emSign roots and reject a real blocked intermediate with CERT_REVOKED.
Full details: Out of Scope Changes check
-
Explanation
The changes stay within Issue [
#1016]. The node source-tarball correction and LIEF patch removal support the required version bump and the new upstream source. The fail-closed build guards and standalone TLS/root tests verify that the carried fixes were replaced by upstream fixes. No unrelated implementation or test changes are shown.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
There was a problem hiding this comment.
LGTM.
- Both tarballs match nodejs.org's
SHASUMS256.txt. - The dropped patches really are upstream:
kBlockedSPKIsis byte-identical to our backport's table (#66871), the three emSign roots are gone (#66877), and the LIEF code was rewritten upstream. - The 15-minute build matches a real node rebuild.
On #817: let's land this first with nodejs.org as the source for both node and node-lts. #817 then needs to re-derive its pins, not just merge main: bundled undici moves to 8.12.2 (node) and 7.30.1 (node-lts), amaro to 1.1.11, and the sha-pinned undici.js blobs will change. #817 should also switch node-lts back to nodejs.org.
Nits:
- The
build.sh:16guard only greps for G3. C1 and C3 are covered only by the test. - Stale comments at
build.ncl:160,164("patched callback") and:125(26.9.0), and the same in node-lts. - The PR body rates CVE-2026-106072 as High; the advisory says Medium. It also omits the two Low Permission Model CVEs. The OpenSSL note doesn't apply under
--shared-openssl.
Generated by Claude Code
|
tls-trust harness (#976) run against this PR's head node 26.12.1 and node-lts 24.22.1: FIXED in every mode.
SELFTEST read FIXED and NEGCONTROL VULNERABLE in every run, so the run is valid. One VULNERABLE row, not caused by this PR: pip 26.2.1 accepts the emSign targets. This branch predates #950 (pip 26.2.2 in ensurepip), so it builds the older python. The PR changes only 🤖 Generated with Claude Code |
…24.22.1, #968) #968 moved both node lines to nodejs.org release tarballs with no carried patches (the CVE-2026-111943 fixes and LIEF 1.x are upstream). The two build.ncl conflicts are resolved by taking main's recipe (nodejs.org Source, no patch Locals, no `patch` dep) and re-applying this branch's additions: the llvm / wasi-libc / llhttp-wasm-rebuild / amaro-wasm build deps, the mirrored npm-undici Source, the type_strip test, and the bundled-version lets, now forwarded through build_args (undici, undici_llhttp, npm_undici, amaro) and re-derived from the 26.12.1 / 24.22.1 trees. node-lts goes back to nodejs.org, as review asked. build.sh merged cleanly (main's guards kept). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Updates node 26.10.0 → 26.12.1 and node-lts 24.19.0 → 24.22.1, both upstream security releases (2026-10-20/21).
Security fixes picked up (from the upstream release notes)
tls: reject chains containing blocked public keys) and #66877 (root certificates → NSS 3.131.1).Carried patches dropped (now upstream)
cve-2026-111943-tls-spki-blocklist.patchandcve-2026-111943-drop-emsign-roots.patch(both packages, from SECURITY: node, node-lts: backport CVE-2026-111943 eMudhra fixes (nodejs/node#66871, #66877) #946): upstream now contains both changes.lief-1.x-macho-section-ctor.patch: 26.12.1 handles the LIEF 1.x API itself (#if LIEF_VERSION_MAJOR >= 1 … Section::create(...)insrc/node_sea_bin.cc). I confirmed the old patch neither applies nor reverse-applies to 26.12.1, so upstream rewrote that code rather than taking the patch.patchis dropped from both packages' build deps.Kept: fail-closed guards and tests
build.shin both packages now checks upstream's fix instead of applying it. The build fails ifkBlockedSPKIsorInstallCertVerifyCallback(sc->ctx_.get())is missing fromsrc/crypto/crypto_context.cc, or ifemSign ECC Root CA - G3reappears insrc/node_root_certs.h. Run against the real 26.12.1 and 24.22.1 sources: pass. Negative control (the root put back): fails, exit 1.emsign_roots_removed, andspki_blocklist_rejects_emudhra_intermediate, which uses a local TLS server with the real compromised intermediate and expectsCERT_REVOKED. They now exercise upstream's code.Source change for node
node's source was a mirrored GitHub tag archive (
gs://…/node-26.10.0.tar.gz, shadadc307a…, which is not nodejs.org'snode-v26.10.0.tar.gz,093087c5…). It now uses nodejs.org's release tarball, the same as node-lts. Both shas were verified against nodejs.org'sSHASUMS256.txt(node717244a8…, node-lts001773d9…).build.shextractsnode-v${version}accordingly.Checks
nickel format --checkclean,bash -nclean,MINIMAL_SCIENCE_MODE=1 mip dump --packagesevaluates on amd64 and arm64.Heads-up
packages/node*/build.{ncl,sh}; whichever merges second needs a merge from main.🤖 Generated with Claude Code
Summary by CodeRabbit
Updates
Security