[renovate]

This PR contains the following updates:

Package	Type	Update	Change
node (source)	uses-with	patch	24.22.1 → 24.22.2

---

Release Notes

nodejs/node (node)

v24.22.2: 2026-10-28, Version 24.22.2 'Krypton' (LTS), @​aduh95

Compare Source

Commits

• [f8bdcd54ed] - deps: V8: backport 786c1c2 (Eliau Elkouby) #​66249
• [3b93fd6b2b] - deps: V8: backport 1a00890 (Jakob Linke) #​65764
• [5aaf62faaa] - deps: V8: backport c9c0abf (Jakob Linke) #​65764
• [3b8eb1a920] - deps: V8: backport ebd1578 (Marja Hölttä) #​65764
• [ab70b5d681] - deps: V8: cherry-pick 853553f (Victor Gomes) #​66241
• [17ec999f24] - stream: keep async context of parked writes (Matteo Collina) #​66907

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ac05e44

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge as-is. This is a patch release with bug fixes, following the October 2026 security release.

📦 Update Summary

• Library: Node.js
• Version: 24.22.1 → 24.22.2
• Change Type: Patch

📝 Release Notes

https://github.com/nodejs/node/releases/tag/v24.22.2

Release Date: October 28, 2026

Commits:

• 5 V8 backports (performance and stability fixes)
• 1 stream fix: Keeps async context of parked writes (#66907)

The main fix addresses a regression in Node.js v24.22.0 where AsyncLocalStorage context was lost in TransformStream writes that wait on backpressure. When a write parks on backpressure and a later read lifts it, the resumption was running transform() and flush() in the reader's async context instead of the writer's. This affected code relying on async context for logging, tracing, or request IDs.

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None introduced. The previous version (v24.22.1, October 21, 2026) was a major security release that fixed 8 CVEs including CVE-2026-111497 (High: Brotli decoder RCE), multiple TLS hostname validation bypasses, and DNS resolution issues. This v24.22.2 release contains only bug fixes.
• Supply-chain notes: None. Node.js is an official LTS release from the nodejs.org project with established maintainers. No maintainer changes, no suspicious lifecycle scripts, no unexpected dependencies.

Previous Security Release (v24.22.1) Fixed:

• CVE-2026-105482 (High): DNS resolution truncates NUL bytes
• CVE-2026-105483 (High): TLS hostname bypass with fullwidth digits
• CVE-2026-106069 (High): TLS hostname bypass with octal IPv4 literals
• CVE-2026-111497 (High): Brotli decoder out-of-bounds write (RCE risk)
• CVE-2026-105481 (Medium): Keep-alive HTTP Agent socket issue
• CVE-2026-106072 (Medium): Non-canonical IPv4 TLS validation
• CVE-2026-106074 (Medium): Entropy cache in startup snapshots
• CVE-2026-106073 (Low): Permission Model bypass in fs.realpathSync

Sources:

• Node.js October 2026 Security Releases
• Node.js Security Releases: 10 CVEs Fixed

🚨 Breaking Changes

None. This is a patch release with backward-compatible bug fixes.

✨ Main Changes

🐛 Bug Fixes

• Stream AsyncLocalStorage Fix: Fixed a regression where AsyncLocalStorage context was lost in TransformStream writes that park on backpressure. The fix captures the async context frame when a write parks and restores it while the continuation runs.

🔧 V8 Backports

• 5 V8 patches backported for performance and stability improvements

🔍 Impact Analysis

📁 Usage Locations

Node.js v24 is used in the following 3 files:

1. .github/workflows/lockfile-audit.yml

   - name: Install pnpm + Node.js
     uses: pnpm/setup@​fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2
     with:
       runtime: node@​24.22.2

   • Feature used: GitHub Actions workflow runtime
   • Impact: ✅ Positive - Benefits from the AsyncLocalStorage fix and security updates from v24.22.1

2. .github/workflows/pkg-pr-new.yml

   matrix:
     include:
       - runtime: node
         pm: npm
         node: 24

   • Feature used: GitHub Actions matrix strategy for smoke tests
   • Impact: ✅ Positive - Test suite runs on patched Node.js version

3. .github/actions/install-deps/action.yml

   inputs:
     node-version:
       description: "Node.js major version to install"
       required: false
       default: "24"

   • Feature used: Reusable GitHub Action with configurable Node.js version
   • Impact: ✅ Positive - All workflows using this action benefit from the update

🔍 AsyncLocalStorage Usage in SDK

The bug fix in v24.22.2 is directly relevant to this codebase. AsyncLocalStorage is used in:

1. packages/sdk/src/cli/telemetry/index.ts

   context.setGlobalContextManager(new AsyncLocalStorageContextManager().enable());

   • Feature used: OpenTelemetry async context management for distributed tracing
   • Impact: ✅ The bug fix ensures tracing context is preserved correctly across async operations, preventing context loss in stream operations

2. packages/sdk/src/cli/shared/config-lock.ts

   const heldLocks = new AsyncLocalStorage<ReadonlySet<string>>();

   • Feature used: Track held locks across async operations to support reentrant locking
   • Impact: ✅ The bug fix ensures lock context is preserved correctly, preventing potential lock tracking issues

ℹ️ TransformStream Reference

• packages/shared/src/node-builtins.ts - Documentation only (suggesting Web Streams API as Node.js alternative)
  • Impact: None - This is just documentation, not actual usage

---