[sticky-gecko]

This PR contains the following updates:

Package	Type	Update	Change
node (source)	tools	patch	24.18.0 → 24.18.1

---

Release Notes

nodejs/node (node)

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #​64713
• [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #​63752
• [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[greptile-apps]

Musl artifact checksums removed

The arm64-musl and x64-musl entries now download Node.js from unofficial-builds.nodejs.org without the SHA-256 checksums retained by the other platform entries, so mise install on a musl host no longer verifies the downloaded binary against pinned content.

How this was verified: Both changed musl entries contain download URLs without checksums, while the adjacent official-platform entries remain checksum-pinned.

[greptile-apps]

Greptile Summary

This PR updates the repository’s pinned Node.js toolchain from 24.18.0 to the 24.18.1 security release.

• Updates the Node.js version in .mise/config.toml.
• Regenerates platform URLs and checksums in .mise/mise.lock.
• Drops checksums from the two unofficial musl artifacts.

Confidence Score: 4/5

The PR appears safe to merge, though restoring checksums for the unofficial musl artifacts would preserve lockfile integrity for musl Linux users.

The version and official-platform metadata are consistent, while the two musl entries remain installable but no longer verify the downloaded Node.js binary against pinned content.

Files Needing Attention: .mise/mise.lock

Security Review

The arm64-musl and x64-musl lock entries no longer authenticate the downloaded Node.js artifacts, weakening supply-chain protection for developers using musl Linux hosts.

T-Rex Logs

What T-Rex did

• Validated the Node 24.18.1 mise pin and official non-musl artifact checksums, and confirmed the updated release metadata matches Node’s published distribution manifest.
• Ran two validation runs; both exited 0, and the after-run fetched SHASUMS256.txt from nodejs.org/dist/v24.18.1/ with HTTP 200, reporting PASS across all five non-musl platforms.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.mise/config.toml	Consistently updates the configured Node.js version from 24.18.0 to 24.18.1.
.mise/mise.lock	Updates Node.js artifact metadata for 24.18.1, but removes integrity checksums from both unofficial musl downloads.

_{Reviews (1): Last reviewed commit: "chore(mise): Update tool node (24.18.0 →..." | Re-trigger Greptile}