2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolito — Node.js

Commits

[4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
[4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485
[e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #62164
[0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382
[e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #62256
[73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
[ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
[b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603
[bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150
[22ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930
[f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
[1a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
[d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #61879
[3ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #61834
[b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
[ffda97afd4] - deps: update googletest to 2461743991f9aa53e9a3625eafcbacd81a3c74cd (Node.js GitHub Bot) #62484
[79aa32cf4f] - deps: update googletest to 73a63ea05dc8ca29ec1d2c1d66481dd0de1950f1 (Node.js GitHub Bot) #61927
[b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
[3a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
[d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #62463
[ec11f3c1d5] - deps: V8: backport 85b390089e51 (Thibaud Michaud) #62783
[08609712ed] - deps: V8: backport 1b27e4674f11 (Thibaud Michaud) #62783
[dcc60d5ab2] - deps: V8: backport 9997fc013952 (Thibaud Michaud) #62783
[1d1f4451fb] - deps: V8: cherry-pick b96e40d5ac85 (Clemens Backes) #62783
[2268567237] - deps: V8: cherry-pick 7cb6188cf913 (Thibaud Michaud) #62783
[92804cdbea] - deps: V8: cherry-pick e7ccf0af1bdd (Thibaud Michaud) #62783
[eae2c27a40] - deps: V8: cherry-pick 8e214ec3ec8c (Thibaud Michaud) #62783
[a1799a49bb] - deps: V8: backport 63b8849d73ae (Thibaud Michaud) #62783
[a2df2d8731] - deps: V8: backport 323942700cfe (Thibaud Michaud) #62783
[e3d65c7dca] - deps: V8: backport 89dc6eab605c (Thibaud Michaud) #62783
[5e7db133de] - deps: V8: backport 910cb91733dc (Jakob Kummerow) #62783
[d0c24a28af] - deps: V8: cherry-pick b8f91e510e0f (Thibaud Michaud) #62783
[d358687824] - deps: V8: cherry-pick cf03d55db2a0 (Thibaud Michaud) #62783
[67c8b2c349] - deps: V8: cherry-pick 692f3d526a38 (Sébastien Doeraene) #62783
[71e5a59ffd] - deps: V8: cherry-pick c734674e03f9 (Manos Koukoutos) #62783
[f0dbe81c7b] - deps: V8: cherry-pick b2f3aea23a01 (Thibaud Michaud) #62783
[d333f480c3] - deps: V8: cherry-pick 5f1342c20b59 (Matthias Liedtke) #62783
[db722725bb] - deps: use npm undici\@six tag in update-undici.sh (Matteo Collina) #63012
[9b57979d9c] - doc: add Rafael to last security release steward (Rafael Gonzaga) #62423
[d8075585bf] - doc: add path to vulnerabilities.json mention (Rafael Gonzaga) #62355
[6ec9a70204] - doc: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) #62208
[1fc86fcb6e] - doc: add note (and caveat) for mock.module about customization hooks (Jacob Smith) #62075
[491be80bd9] - doc: add efekrskl as triager (Efe) #61876
[18558293a3] - doc: fix module.stripTypeScriptTypes indentation (René) #61992
[8e20976522] - doc: explicitly mention Slack handle (Rafael Gonzaga) #61986
[70b8e6b4fb] - doc: rename invalid function parameter (René) #61942
[4045c76f6c] - doc: clarify status of feature request issues (Antoine du Hamel) #61505
[c54652f2aa] - doc: remove incorrect mention of module in typescript.md (Rob Palmer) #61839
[9fad6cedf5] - doc: clarify async caveats for events.once() (René) #61572
[2f1e5733fe] - doc: update Juan’s security steward info (Juan José) #61754
[a64bdb5068] - doc: fix overstated Date header requirement in response.sendDate (Kit Dallege) #62206
[02797de923] - doc: fix small environment_variables typo (chris) #62279
[f22ebdc809] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #62025
[9f4508062a] - doc: fix methods being documented as properties in process.md (Antoine du Hamel) #61765
[3ea39ff135] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #61735
[c22445079b] - doc: fix spacing in process message event (Aviv Keller) #61756
[32831b5223] - doc: fix broken links of net.md (YuSheng Chen) #61673
[005508d509] - doc: remove obsolete Boxstarter automated install (Mike McCready) #61785
[37c2fd6f7d] - esm: fix path normalization in finalizeResolution (Antoine du Hamel) #62080
[1769d74613] - esm: populate separate cache for require(esm) in imported CJS (Joyee Cheung) #59679
[ee02966ffc] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #61710
[2fdb5ce6cc] - http2: fix FileHandle leak in respondWithFile (sangwook) #61707
[aa2c1eca04] - lib: fix source map url parse in dynamic imports (Chengzhong Wu) #61990
[785b00cbeb] - meta: pass release version to release worker (flakey5) #62777
[447fb9a0b5] - meta: persist sccache daemon until end of build workflows (René) #61639
[5065a0acb3] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #61529
[9a2e21305d] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #61479
[b9240bc063] - module: fix sync resolve hooks for require with node: prefixes (Joyee Cheung) #61088
[2e91b28aaf] - module: handle null source from async loader hooks in sync hooks (Joyee Cheung) #59929
[39147c154e] - module: use sync cjs when importing cts (Marco Ippolito) #60072
[12a2462b2c] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874
[cf39566277] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948
[578a9a9230] - src: clamp WriteUtf8 capacity to INT_MAX in EncodeInto (semimikoh) #62621
[57c3035fec] - stream: fix decoded fromList chunk boundary check (Thomas Watson) #61884
[57fb008bb8] - test: update tls junk data error expectations (Filip Skokan) #62629
[363f9a9d18] - test: skip test-url on --shared-ada builds (Antoine du Hamel) #62019
[daaead342b] - test: simplify encodeInto large buffer regression test (semimikoh) #62621
[ecfa766b41] - tools: fix auto-start-ci (Antoine du Hamel) #61900
[17c0a610af] - tools: fix parsing of commit trailers in lint-release-proposal GHA (Antoine du Hamel) #62077
[89ad7dc63b] - tools: enforce removal of lts-watch-* labels on release proposals (Antoine du Hamel) #61672
[5f9bb8ef0c] - tools: revert tools GHA workflow to ubuntu-latest (Richard Lau) #62024
[977ef80ac1] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #62574
[ad8f518a81] - zlib: fix use-after-free when reset() is called during write (Matteo Collina) #62325