chore: Update all non-major dependencies (v3.x.x) - #4923
Merged
Conversation
Signed-off-by: Renovate Bot <renovate@whitesourcesoftware.com>
|
balhar-jakub
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.19.0→1.20.04.3.1→4.3.24.3.1→4.3.2=24.19.0→=24.20.0Release Notes
axios/axios (axios)
v1.20.0Compare Source
v1.20.0 — August 19, 2026
This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.
🔒 Security Fixes
🐛 Bug Fixes
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog (axios/axios@v1.19.0...v1.20.0)
nodeca/js-yaml (js-yaml)
v4.3.2Compare Source
nodejs/node (node)
v24.20.0: 2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b12bcc9ae1] - (SEMVER-MINOR) async_hooks: addusingscopes toAsyncLocalStorage(Stephen Belanger) #61674e2eb88b36b] - (SEMVER-MINOR) buffer: addendparameter (Robert Nagy) #623901fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #647464a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656d4cafce076] - (SEMVER-MINOR) lib,permission: addpermission.drop(Rafael Gonzaga) #62672b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239cd1eb3e60b] - (SEMVER-MINOR) src,permission: add--permission-audit(RafaelGSS) #6186928dc85d8d2] - (SEMVER-MINOR) stream: addnode:stream/iterimplementation (James M Snell) #62066d31c168740] - (SEMVER-MINOR) test_runner: addcontext.log()and test:log event (Moshe Atlow) #64389add1edbc42] - (SEMVER-MINOR) test_runner: reportentryFileinTestStreamevents (Moshe Atlow) #64309d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #59941Commits
1822c0f335] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674984260bf44] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731ba2612cca2] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146236dc4d2d7] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291b022a1419c] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314a290f51f15] - (SEMVER-MINOR) benchmark: add benchmarks for experimental stream/iter (James M Snell) #62066465f2bfb74] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #6473974a22cd0c5] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #6390421e24208dc] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115ddacb3ff10] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #6357749198d2313] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390e2e5c4fe88] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282b78a212553] - build: pin envinfo versions in github actions (Joyee Cheung) #64117094fb840aa] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #6387591f5003cad] - build: fix flags for ngtcp2 on IBM i (SRAVANI GUNDEPALLI) #60073e83648effd] - build,test: add tests for binary linked with shared libnode (Joyee Cheung) #614634a425b41d9] - build,tools: fix shared library cross-compile (Kirill Saied) #63963fe8fa45ff2] - cli: style node --help output with util.styleText (Adrián Estrada) #644843cd1576cb2] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #6477674b3023565] - crypto: handle XOF output allocation failure (Filip Skokan) #64851fea0666a1b] - crypto: clarify missing cipher error (Filip Skokan) #6485233fec91b54] - crypto: reuse X509 issuer result (Filip Skokan) #6485244c1473348] - crypto: validate key generation options (Filip Skokan) #64852c2c53a18e5] - crypto: fix Argon2 validation errors (Filip Skokan) #64852edc1f2126d] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851be8237240c] - crypto: handle DH operation failures (Filip Skokan) #64851b65a8f3875] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #6454749f2ae204b] - crypto: cleanse provider private key copies (Filip Skokan) #64547a5d4ac8208] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547b72c0b9616] - crypto: retain legacy DH validation (Filip Skokan) #6454724a1be5886] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #645570290e0a61e] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211ba27e72ff8] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #647761fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746c0dd022081] - crypto: use user-facing error for output encoding changes (Archkon) #64692ff485a9410] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #606781329d9b9f1] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #6446782a02336aa] - deps: V8: backportd259a9e(Leszek Swirski) #63865f0fc82d404] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944c4e02f0fbc] - deps: upgrade npm to 11.19.0 (npm team) #64883d5a57ed4dd] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #6494351d413150a] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #6494521f79ce140] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #649427a4960d6a9] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #649415c423aa113] - deps: update googletest to1b6f64d(Node.js GitHub Bot) #6494040561e61b0] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #6493951090925b0] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #647447c534bf8e5] - deps: V8: backport5177b10(avivkeller) #646317b1898a341] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #647909209cc4095] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #647453833fceff6] - deps: update googletest tofa005b2(Node.js GitHub Bot) #64587bc7ce488d1] - deps: histogram: cherry-pick62ea52b(StefanStojanovic) #64296e3fa05841d] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296e75bdb9bbe] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #645861e034e6e40] - deps: update timezone to 2026c (Node.js GitHub Bot) #645882b8f1f27bd] - deps: update googletest to8240fa7(Node.js GitHub Bot) #64439241ece0417] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606215105eb90] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #643307ac97fc84e] - deps: upgrade npm to 11.18.0 (npm team) #641998d4cb9ae46] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295564c0f4592] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297e3304cd31a] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182345d6ad4eb] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777a53db015e6] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #637761f4a5c1c76] - deps: update ngtcp2 to 1.22.1 (Node.js GitHub Bot) #62812080c4d7cda] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #625954309e7c82f] - deps: update ngtcp2 to 1.21.0 (Node.js GitHub Bot) #6205190cf11cfb5] - deps: update nghttp3 to 1.15.0 (Node.js GitHub Bot) #61512e1f315a554] - deps: update ngtcp2 to 1.20.0 (Node.js GitHub Bot) #615119a3f690c9d] - deps: update ngtcp2 to 1.19.0 (Node.js GitHub Bot) #61156fe88f31764] - deps: add ngtcp2 test binaries (James M Snell) #599466d60fce138] - diagnostics_channel: grow native channel storage (Stephen Belanger) #6449730ae8ab091] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #647918cefc6efa8] - doc: fix guaranteed typo (lilianakatrina684-a11y) #623742e78e4b120] - doc: add throwIfNoEntry version history to fs.stat (kovan) #62204c7a04401cb] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957331e5e8f62] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952232287fcc6] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #649467f9efeb445] - doc: remove references toca/crlas per-context QuicSession options (René) #64769b54aa83cc6] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896f4e427803c] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843f2cd6df3f3] - doc: fix typos in documentation (greenhead) #64900d5627162bd] - doc: improve TestContext hook descriptions (Kamal Rawal) #6489972ee03bd2e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789995141eb81] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862dc30379310] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837205d4d0472] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814108b883d0b] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806b03bd3a8ed] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584093098ad7f] - doc: stabilize --disable-warning (Jean Michelet) #647422de1d76d80] - doc: add MDN links for explicit resource management in fs (lluisemper) #595572e0f36a891] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #620101c9d354d09] - doc: update technical priorities (Jacob Smith) #6450530c99bf08f] - doc: deprecation add more codemod (Augustin Mauroy) #631758a971a09eb] - doc: run license-builder (Node.js GitHub Bot) #63918707f6eacfc] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648928208cffc] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634ee593cadf5] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #646589c228b32d1] - doc: fix typo in releases guide (Jihwan) #646214a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #646568125809853] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #643712a2effadf6] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112c879f912bf] - doc: mention crypto.hash() for better perf (Steven) #63420634afda904] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025bced1433a3] - doc: fix socket.readyState state descriptions (YuSheng Chen) #644684b2c18938f] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #645825207231996] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442329a2884fd] - doc: fix typo in embedding.md (greenhead) #64425fab3f56aa1] - doc: fix typos in contributing docs (Donghoon Kang) #64520cbc2bed4e8] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362dada3ae60e] - doc: fix spelling in devcontainer guide (한만욱) #6445971343b28aa] - doc: clarify PEM format for signing keys (Harjoth Khara) #644040544ec1c78] - doc: fix typo in tls.md (Daijiro Wachi) #644588fe58078e7] - doc: document net Socket server property (Efe Karasakal) #64364d54fd03fa4] - doc: update a Dispatcher undici doc link (Filip Skokan) #643581bdebecd41] - doc: fix typos in documentation (Jungwon Sohn) #6446686bca58641] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421b5b84c9394] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386004238d77c] - doc: clarify proxy threat model (Matteo Collina) #643666851b8d55f] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321662e33714a] - doc: various updates to releases.md (Stewart X Addison) #64198949bc3cfd3] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220830d16067f] - doc: clarify QUIC stream state wording (EduardF1) #6366079b6704630] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #641889f5bf554db] - doc: fix broken link (Antoine du Hamel) #6507842b27ed428] - doc: remove unsupported syntax fromstream_iter.md(Antoine du Hamel) #64649f1a9df7f22] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682c7a3d450ac] - doc: improve quic documentation (James M Snell) #63157cc425bc659] - doc: fix promise nomenclature instream_iter.md(Antoine du Hamel) #63406859a02da96] - doc: minor structural stream/iter edits (René) #63089630b15eb20] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #6291650791fa8fa] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #642799e39360a09] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260d2b02e443a] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154e8c153f3f4] - events: avoid retaining removed event names (Matteo Collina) #6447573e1701bad] - events: optimize once() and removeListener() (Matteo Collina) #6437312f7fc0558] - fs: key glob matcher cache by platform (Archkon) #64571e5af022302] - fs: add pattern cache for matchGlobPattern() (bq) #6391563321eeb11] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #643530ad55e5618] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847ee54d9d4d2] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #6439214cb8b0a06] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506f24177ccc6] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #6465355e2c2da8c] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #64311b57350fe27] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #64370af3a17e0b3] - http2: avoid copying the options in respond() (Matteo Collina) #64265f11ac0da37] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265157bd07b6e] - http2: reduce per-request allocations (Matteo Collina) #64265b075b33429] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427445bcce079] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #6432806b54fe7d3] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481d8fac094d1] - lib: fix typo in comment in _http_client.js (agape1225) #647299ce72fd6fb] - lib: useassignFunctionNameutil where it makes sense (Antoine du Hamel) #64515c40d1473e6] - lib,permission: fix addon permission drop (Martin Wagner) #64007d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #626726b09d30a76] - lib,tools: addnode-core/func-name-matchinglint rule (Livia Medeiros) #57901d7d4f0e2ac] - loader: enforce path normalization before lookup (Maël Nison) #63917b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239cf425ad935] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #6493526fa9cc32b] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934c90fa82cd7] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933314893253a] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #649326ab711278f] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #649319138f5892a] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #649303ef3f934d4] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927a0a33127ae] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #649264ad2afbf33] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925d9b2ee4083] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #647372b43b78e82] - meta: lower stale to 3 months (Aviv Keller) #645690ffe8352ae] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315afd922cd8a] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245b6149a2976] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #642418f4a5c622f] - meta: update sccache version in test-linux-quic (René) #640439040b08696] - net: support TCP handle transfer on Windows (Matteo Collina) #644601216481a09] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399f6bf3f8a5d] - net: support sync connect for BoundSocket (Guy Bedford) #64375fb8a7e15ca] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225224d2c7886] - path: add benchmarks for path.matchesGlob() (bq) #63915980c651de5] - permission: add unique warning codes (David Evans) #644149f9a96030d] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #648088a00872183] - quic: fix stop sending behaviour & callback (Tim Perry) #647107aab0c3183] - quic: fix coverage comment typo (Jungwon Sohn) #64486b4ecb3040b] - quic: fix segfault after fragmented client hello (Tim Perry) #647206386540dad] - quic: serialize stream reset code as string (한만욱) #6457782717741c9] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #641327cb3099907] - quic: preserve session stats after close (한만욱) #6448950e639b578] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434e2e28292cc] - quic: extract transport logic from Application to Session (Tim Perry) #641272ef4b7ebf2] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289a682b53456] - quic: fix no onstream handler crash quic (Efe) #641589445e2719a] - quic: fix stall datagrams, if no pending streams (Marten Richter) #643032ea9d193bd] - quic: fix potential crash from unobserved closed (Tim Perry) #641343b7f4fc1fb] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228bd477a3202] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #641703dd04b3ec6] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #639464be8abe8f9] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191e264c5c0cb] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #639502f749dde18] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #635585ca7ef3202] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874147150cfdd] - quic: add listEndpoints API (James M Snell) #635363b59d12f5d] - quic: add proper error codes & messages for QUIC failures (Tim Perry) #63198b68f8eadb9] - quic: support hostname verification (James M Snell) #634837652bd9c6d] - quic: add stream idle timeout (James M Snell) #63483e493f04214] - quic: add block list support for endpoints (James M Snell) #634836d6cd45f8b] - quic: improve peer cert verification (James M Snell) #63483dbe0b371ee] - quic: handle h3 max header size option (James M Snell) #6348339dca4150c] - quic: add rate limiting docs (James M Snell) #63483c726a893d6] - quic: cache timestamp for address lru cache (James M Snell) #6348311778a7925] - quic: add session creation rate limiting (James M Snell) #634838107f1b3ed] - quic: refine rate limiting (James M Snell) #63483Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.