Repository navigation
Update node to 26.12.1 and node-lts to 24.22.1 (security; upstream eMudhra fix, drop carried patches) - #968
bryan-minimal wants to merge 1 commit into
Conversation
…d patches) Both are upstream security releases and both carry the CVE-2026-111943 fixes (nodejs/node#66871 SPKI blocklist, #66877 NSS 3.131.1 roots), so the backports from #946 are dropped; node 26.12.1 also handles the LIEF 1.x Section API itself, so its LIEF patch goes too, and with it the `patch` build dep. build.sh now fails closed if a future version regresses either fix. node moves to nodejs.org's release tarball (same as node-lts), sha verified against SHASUMS256.txt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the Node.js version updates and the removal of carried security patches. It accurately summarizes the main changes. |
| Linked Issues check | |
Issue [#1016] requires Node 26.x and 24.x LTS releases that contain both CVE-2026-111943 fixes, deletion of both carried patches, and protection against double application. The PR sets versions to 26.… |
| Out of Scope Changes check | |
The changes stay within Issue [#1016]. The node source-tarball correction and LIEF patch removal support the required version bump and the new upstream source. The fail-closed build guards and standal… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2… |
Full details: Linked Issues check
-
Explanation
Issue [
#1016] requires Node 26.x and 24.x LTS releases that contain both CVE-2026-111943 fixes, deletion of both carried patches, and protection against double application. The PR sets versions to 26.12.1 and 24.22.1, uses verified nodejs.org release checksums, deletes both patch files for each package, removes the patch dependencies, and removes patch application commands. Both build scripts fail when the upstream SPKI blocklist or certificate callback is absent. The package tests check removal of all three compromised emSign roots and reject a real blocked intermediate with CERT_REVOKED.
Full details: Out of Scope Changes check
-
Explanation
The changes stay within Issue [
#1016]. The node source-tarball correction and LIEF patch removal support the required version bump and the new upstream source. The fail-closed build guards and standalone TLS/root tests verify that the carried fixes were replaced by upstream fixes. No unrelated implementation or test changes are shown.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
1 participant
Updates node 26.10.0 → 26.12.1 and node-lts 24.19.0 → 24.22.1, both upstream security releases (2026-10-20/21).
Security fixes picked up (from the upstream release notes)
tls: reject chains containing blocked public keys) and #66877 (root certificates → NSS 3.131.1).Carried patches dropped (now upstream)
cve-2026-111943-tls-spki-blocklist.patchandcve-2026-111943-drop-emsign-roots.patch(both packages, from SECURITY: node, node-lts: backport CVE-2026-111943 eMudhra fixes (nodejs/node#66871, #66877) #946): upstream now contains both changes.lief-1.x-macho-section-ctor.patch: 26.12.1 handles the LIEF 1.x API itself (#if LIEF_VERSION_MAJOR >= 1 … Section::create(...)insrc/node_sea_bin.cc). I confirmed the old patch neither applies nor reverse-applies to 26.12.1, so upstream rewrote that code rather than taking the patch.patchis dropped from both packages' build deps.Kept: fail-closed guards and tests
build.shin both packages now checks upstream's fix instead of applying it. The build fails ifkBlockedSPKIsorInstallCertVerifyCallback(sc->ctx_.get())is missing fromsrc/crypto/crypto_context.cc, or ifemSign ECC Root CA - G3reappears insrc/node_root_certs.h. Run against the real 26.12.1 and 24.22.1 sources: pass. Negative control (the root put back): fails, exit 1.emsign_roots_removed, andspki_blocklist_rejects_emudhra_intermediate, which uses a local TLS server with the real compromised intermediate and expectsCERT_REVOKED. They now exercise upstream's code.Source change for node
node's source was a mirrored GitHub tag archive (
gs://…/node-26.10.0.tar.gz, shadadc307a…, which is not nodejs.org'snode-v26.10.0.tar.gz,093087c5…). It now uses nodejs.org's release tarball, the same as node-lts. Both shas were verified against nodejs.org'sSHASUMS256.txt(node717244a8…, node-lts001773d9…).build.shextractsnode-v${version}accordingly.Checks
nickel format --checkclean,bash -nclean,MINIMAL_SCIENCE_MODE=1 mip dump --packagesevaluates on amd64 and arm64.Heads-up
packages/node*/build.{ncl,sh}; whichever merges second needs a merge from main.🤖 Generated with Claude Code
Summary by CodeRabbit
Updates
Security