node-bin-darwin-arm64 22.23.1 → 22.23.3

package/CHANGELOG.md

@@ -9,6 +9,8 @@
 </tr>
 <tr>
 <td>
+<a href="#22.23.3">22.23.3</a><br/>
+<a href="#22.23.2">22.23.2</a><br/>
 <a href="#22.23.1">22.23.1</a><br/>
 <a href="#22.23.0">22.23.0</a><br/>
 <a href="#22.22.3">22.22.3</a><br/>
@@ -73,6 +75,96 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="22.23.3"></a>
+
+## 2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbol
+
+### Notable Changes
+
+* \[[`fe2a6b2be8`](https://github.com/nodejs/node/commit/fe2a6b2be8)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](https://github.com/nodejs/node/pull/64746)
+* \[[`871167ddfd`](https://github.com/nodejs/node/commit/871167ddfd)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`b816fc8958`](https://github.com/nodejs/node/commit/b816fc8958)] - **deps**: upgrade npm to 10.9.9 (npm team) [#64884](https://github.com/nodejs/node/pull/64884)
+* \[[`e306521444`](https://github.com/nodejs/node/commit/e306521444)] - **deps**: update icu to 78.3 (Node.js GitHub Bot) [#62324](https://github.com/nodejs/node/pull/62324)
+* \[[`a9cb31129f`](https://github.com/nodejs/node/commit/a9cb31129f)] - **deps**: update OpenSSL 3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`2a3548e51c`](https://github.com/nodejs/node/commit/2a3548e51c)] - **deps**: update Undici to 6.28.1 (mcollina) [#65790](https://github.com/nodejs/node/pull/65790)
+* \[[`3909ff2c4a`](https://github.com/nodejs/node/commit/3909ff2c4a)] - **node-api**: support `SharedArrayBuffer` in `napi_create_typedarray` (Yilong Li) [#62710](https://github.com/nodejs/node/pull/62710)
+* \[[`66de6349ad`](https://github.com/nodejs/node/commit/66de6349ad)] - **node-api**: add `napi_create_external_sharedarraybuffer` (Ben Noordhuis) [#62623](https://github.com/nodejs/node/pull/62623)
+
+### Commits
+
+* \[[`44cf27b8fa`](https://github.com/nodejs/node/commit/44cf27b8fa)] - **build**: update binary-upload to use correct tarball name (Stewart X Addison) [#65282](https://github.com/nodejs/node/pull/65282)
+* \[[`fe2a6b2be8`](https://github.com/nodejs/node/commit/fe2a6b2be8)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](https://github.com/nodejs/node/pull/64746)
+* \[[`71feba6b69`](https://github.com/nodejs/node/commit/71feba6b69)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](https://github.com/nodejs/node/pull/63527)
+* \[[`871167ddfd`](https://github.com/nodejs/node/commit/871167ddfd)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`2a3548e51c`](https://github.com/nodejs/node/commit/2a3548e51c)] - **deps**: update undici to 6.28.1 (mcollina) [#65790](https://github.com/nodejs/node/pull/65790)
+* \[[`59d853a4df`](https://github.com/nodejs/node/commit/59d853a4df)] - **deps**: update archs files for openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`a9cb31129f`](https://github.com/nodejs/node/commit/a9cb31129f)] - **deps**: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`3376e27de2`](https://github.com/nodejs/node/commit/3376e27de2)] - **deps**: V8: cherry-pick a6eaf7574109 (Camillo Bruni) [#65402](https://github.com/nodejs/node/pull/65402)
+* \[[`b816fc8958`](https://github.com/nodejs/node/commit/b816fc8958)] - **deps**: upgrade npm to 10.9.9 (npm team) [#64884](https://github.com/nodejs/node/pull/64884)
+* \[[`4e4bd1b104`](https://github.com/nodejs/node/commit/4e4bd1b104)] - **deps**: update timezone to 2026c (Node.js GitHub Bot) [#64588](https://github.com/nodejs/node/pull/64588)
+* \[[`7d82841b4e`](https://github.com/nodejs/node/commit/7d82841b4e)] - **deps**: update c-ares to 1.34.8 (Node.js GitHub Bot) [#64330](https://github.com/nodejs/node/pull/64330)
+* \[[`01855a19d3`](https://github.com/nodejs/node/commit/01855a19d3)] - **deps**: c-ares: cherry-pick 8ba37af8e3fb (René) [#64110](https://github.com/nodejs/node/pull/64110)
+* \[[`23fb398c3d`](https://github.com/nodejs/node/commit/23fb398c3d)] - **deps**: update corepack to 0.35.0 (Node.js GitHub Bot) [#63375](https://github.com/nodejs/node/pull/63375)
+* \[[`5286330365`](https://github.com/nodejs/node/commit/5286330365)] - **deps**: update corepack to 0.34.7 (Node.js GitHub Bot) [#62810](https://github.com/nodejs/node/pull/62810)
+* \[[`6d6c3c98b1`](https://github.com/nodejs/node/commit/6d6c3c98b1)] - **deps**: update timezone to 2026b (Node.js GitHub Bot) [#62962](https://github.com/nodejs/node/pull/62962)
+* \[[`e306521444`](https://github.com/nodejs/node/commit/e306521444)] - **deps**: update icu to 78.3 (Node.js GitHub Bot) [#62324](https://github.com/nodejs/node/pull/62324)
+* \[[`d9cb8468a3`](https://github.com/nodejs/node/commit/d9cb8468a3)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#63515](https://github.com/nodejs/node/pull/63515)
+* \[[`c9c5662d91`](https://github.com/nodejs/node/commit/c9c5662d91)] - **doc**: add sxa GPG key (ed25519) (Stewart X Addison) [#64193](https://github.com/nodejs/node/pull/64193)
+* \[[`37f21068c4`](https://github.com/nodejs/node/commit/37f21068c4)] - **fs**: restore fs patchability in ESM loader (Joyee Cheung) [#62835](https://github.com/nodejs/node/pull/62835)
+* \[[`7c2df5dd96`](https://github.com/nodejs/node/commit/7c2df5dd96)] - **http2**: avoid uaf while receiving and sending rst\_stream (esgor) [#64166](https://github.com/nodejs/node/pull/64166)
+* \[[`3909ff2c4a`](https://github.com/nodejs/node/commit/3909ff2c4a)] - **node-api**: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) [#62710](https://github.com/nodejs/node/pull/62710)
+* \[[`66de6349ad`](https://github.com/nodejs/node/commit/66de6349ad)] - **node-api**: add napi\_create\_external\_sharedarraybuffer (Ben Noordhuis) [#62623](https://github.com/nodejs/node/pull/62623)
+* \[[`ce9139107f`](https://github.com/nodejs/node/commit/ce9139107f)] - **src**: escape Windows environment variables in task runner (Antoine du Hamel) [#65217](https://github.com/nodejs/node/pull/65217)
+* \[[`839480a471`](https://github.com/nodejs/node/commit/839480a471)] - **test**: fix link-local dgram scope assertion (Filip Skokan) [#65629](https://github.com/nodejs/node/pull/65629)
+* \[[`40eac4a32f`](https://github.com/nodejs/node/commit/40eac4a32f)] - **test**: account for varied OpenSSL CCM final behaviours (Filip Skokan) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`75098a9e8c`](https://github.com/nodejs/node/commit/75098a9e8c)] - **tools**: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) [#63065](https://github.com/nodejs/node/pull/63065)
+* \[[`08b6ac0416`](https://github.com/nodejs/node/commit/08b6ac0416)] - **tools**: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) [#62627](https://github.com/nodejs/node/pull/62627)
+* \[[`02cafc479f`](https://github.com/nodejs/node/commit/02cafc479f)] - **tools**: fix commit linter for semver-major release proposals (Antoine du Hamel) [#62993](https://github.com/nodejs/node/pull/62993)
+* \[[`6f6cd3768d`](https://github.com/nodejs/node/commit/6f6cd3768d)] - **tools**: sync mk-ca-bundle.pl with curl (Archkon) [#64753](https://github.com/nodejs/node/pull/64753)
+* \[[`bc5753d438`](https://github.com/nodejs/node/commit/bc5753d438)] - **tools**: remove `envinfo` from our workflows (Antoine du Hamel) [#64259](https://github.com/nodejs/node/pull/64259)
+* \[[`d68ee9f8a5`](https://github.com/nodejs/node/commit/d68ee9f8a5)] - **tools**: validate version number in release proposal commit message lint (Antoine du Hamel) [#64070](https://github.com/nodejs/node/pull/64070)
+* \[[`38ee2e895f`](https://github.com/nodejs/node/commit/38ee2e895f)] - **tools**: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) [#63938](https://github.com/nodejs/node/pull/63938)
+* \[[`fdc65e489f`](https://github.com/nodejs/node/commit/fdc65e489f)] - **tools**: use different branch for tool updates on staging branches (Antoine du Hamel) [#63110](https://github.com/nodejs/node/pull/63110)
+* \[[`e5a6fde002`](https://github.com/nodejs/node/commit/e5a6fde002)] - **tools**: update gyp-next to 0.22.1 (Node.js GitHub Bot) [#62961](https://github.com/nodejs/node/pull/62961)
+* \[[`5fbbad6e82`](https://github.com/nodejs/node/commit/5fbbad6e82)] - **url**: handle unparsable serialized URLs in setters (Matteo Collina) [#64651](https://github.com/nodejs/node/pull/64651)
+* \[[`ed019e4854`](https://github.com/nodejs/node/commit/ed019e4854)] - **util**: preserve function names without source map names (Hiroki Osame) [#65108](https://github.com/nodejs/node/pull/65108)
+
+<a id="22.23.2"></a>
+
+## 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolito
+
+This is a security release.
+
+### Notable Changes
+
+* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
+* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
+* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
+* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
+* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
+* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
+* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
+* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
+* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
+* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
+* deps: update llhttp to 9.4.3 (Paolo Insogna)
+* deps: update undici to 6.28.0 (Node.js GitHub Bot)
+
+### Commits
+
+* \[[`4b12ac38a1`](https://github.com/nodejs/node/commit/4b12ac38a1)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
+* \[[`3fd0aa51d0`](https://github.com/nodejs/node/commit/3fd0aa51d0)] - **deps**: update undici to 6.28.0 (Node.js GitHub Bot) [#64714](https://github.com/nodejs/node/pull/64714)
+* \[[`22efc051a3`](https://github.com/nodejs/node/commit/22efc051a3)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
+* \[[`c8525ac3a6`](https://github.com/nodejs/node/commit/c8525ac3a6)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#932](https://github.com/nodejs-private/node-private/pull/932)
+* \[[`daa6d25e3d`](https://github.com/nodejs/node/commit/daa6d25e3d)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
+* \[[`f14d78b9e0`](https://github.com/nodejs/node/commit/f14d78b9e0)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752)
+* \[[`51123159fe`](https://github.com/nodejs/node/commit/51123159fe)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#934](https://github.com/nodejs-private/node-private/pull/934)
+* \[[`acaf4266b2`](https://github.com/nodejs/node/commit/acaf4266b2)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
+* \[[`440329f624`](https://github.com/nodejs/node/commit/440329f624)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
+* \[[`ed18b9cc07`](https://github.com/nodejs/node/commit/ed18b9cc07)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926)
+* \[[`0566c3cccd`](https://github.com/nodejs/node/commit/0566c3cccd)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927)
+* \[[`0d072480c3`](https://github.com/nodejs/node/commit/0d072480c3)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)
+
 <a id="22.23.1"></a>
 
 ## 2026-06-23, Version 22.23.1 'Jod' (LTS), @RafaelGSS

package/README.md

@@ -805,6 +805,8 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
   `C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C`
 * **Ruy Adorno** <<ruyadorno@hotmail.com>>
   `108F52B48DB57BB0CC439B2997B01419BD92F80A`
+* **Stewart X Addison** <<sxa@ibm.com>>
+  `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`
 * **Ulises Gascón** <<ulisesgascongonzalez@gmail.com>>
   `A363A499291CBBC940DD62E41F10027AF002F8B0`
 
@@ -822,6 +824,7 @@ gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
 gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD # Stewart X Addison
 gpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises Gascón
 ```
 

package/bin/node

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/node
-size: 112928848 bytes
-sha256: 2e3f1286a7eb3736346ed1803e458a0ff909e2b2d5bc746144dcb76970e9b99d
+size: 112925600 bytes
+sha256: 68f4d07ca49e0500cc135c7e0a445093e228e42e126ac22306d045f0a8c2636b

package/include/node/common.gypi

@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.56',
+    'v8_embedder_string': '-node.57',
 
     ##### V8 defaults for Node.js #####
 

package/include/node/js_native_api.h

@@ -420,6 +420,16 @@ napi_create_external_arraybuffer(napi_env env,
                                  node_api_basic_finalize finalize_cb,
                                  void* finalize_hint,
                                  napi_value* result);
+#ifdef NAPI_EXPERIMENTAL
+#define NODE_API_EXPERIMENTAL_HAS_CREATE_EXTERNAL_SHAREDARRAYBUFFER
+NAPI_EXTERN napi_status NAPI_CDECL
+node_api_create_external_sharedarraybuffer(napi_env env,
+                                           void* external_data,
+                                           size_t byte_length,
+                                           node_api_noenv_finalize finalize_cb,
+                                           void* finalize_hint,
+                                           napi_value* result);
+#endif  // NAPI_EXPERIMENTAL
 #endif  // NODE_API_NO_EXTERNAL_BUFFERS_ALLOWED
 NAPI_EXTERN napi_status NAPI_CDECL napi_get_arraybuffer_info(
     napi_env env, napi_value arraybuffer, void** data, size_t* byte_length);

package/include/node/js_native_api_types.h

@@ -174,6 +174,10 @@ typedef void(NAPI_CDECL* node_api_nogc_finalize)(node_api_nogc_env env,
 #endif
 typedef node_api_nogc_finalize node_api_basic_finalize;
 
+// A finalizer that can be called from any thread and at any time.
+typedef void(NAPI_CDECL* node_api_noenv_finalize)(void* finalize_data,
+                                                  void* finalize_hint);
+
 typedef struct {
   // One of utf8name or name should be NULL.
   const char* utf8name;

package/include/node/node_version.h

@@ -24,7 +24,7 @@
 
 #define NODE_MAJOR_VERSION 22
 #define NODE_MINOR_VERSION 23
-#define NODE_PATCH_VERSION 1
+#define NODE_PATCH_VERSION 3
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Jod"

package/include/node/openssl/archs/BSD-x86/asm/crypto/buildinf.h

@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Tue Jun  9 13:41:00 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:29 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a

package/include/node/openssl/archs/BSD-x86/asm/include/openssl/opensslv.h

@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */

package/include/node/openssl/archs/BSD-x86/asm/include/openssl/ssl.h

@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);

package/include/node/openssl/archs/BSD-x86/asm_avx2/crypto/buildinf.h

@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Tue Jun  9 13:41:17 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:44 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a

package/include/node/openssl/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h

@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */

package/include/node/openssl/archs/BSD-x86/asm_avx2/include/openssl/ssl.h

@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);

package/include/node/openssl/archs/BSD-x86/no-asm/crypto/buildinf.h

@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Tue Jun  9 13:41:33 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:44:58 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a

package/include/node/openssl/archs/BSD-x86/no-asm/include/openssl/opensslv.h

@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */

package/include/node/openssl/archs/BSD-x86/no-asm/include/openssl/ssl.h

@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);

package/include/node/openssl/archs/BSD-x86_64/asm/crypto/buildinf.h

@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Tue Jun  9 13:41:48 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:45:12 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a

package/include/node/openssl/archs/BSD-x86_64/asm/include/openssl/opensslv.h

@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */

package/include/node/openssl/archs/BSD-x86_64/asm/include/openssl/ssl.h

@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);

package/include/node/openssl/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h

@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Tue Jun  9 13:42:10 2026 UTC"
+#define DATE "built on: Tue Aug 25 12:45:34 2026 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a

package/include/node/openssl/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h

@@ -34,7 +34,7 @@ extern "C" {
 # define OPENSSL_VERSION_MINOR  5
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_VERSION_PATCH  7
+# define OPENSSL_VERSION_PATCH  8
 /* clang-format on */
 
 /*
@@ -87,10 +87,10 @@ extern "C" {
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
 /* clang-format off */
-# define OPENSSL_VERSION_STR "3.5.7"
+# define OPENSSL_VERSION_STR "3.5.8"
 /* clang-format on */
 /* clang-format off */
-# define OPENSSL_FULL_VERSION_STR "3.5.7"
+# define OPENSSL_FULL_VERSION_STR "3.5.8"
 /* clang-format on */
 
 /*
@@ -99,7 +99,7 @@ extern "C" {
  * These strings are defined separately to allow them to be parsable.
  */
 /* clang-format off */
-# define OPENSSL_RELEASE_DATE "9 Jun 2026"
+# define OPENSSL_RELEASE_DATE "25 Aug 2026"
 /* clang-format on */
 
 /*
@@ -107,7 +107,7 @@ extern "C" {
  */
 
 /* clang-format off */
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.7 9 Jun 2026"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.8 25 Aug 2026"
 /* clang-format on */
 
 /* clang-format off */

package/include/node/openssl/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h

@@ -2488,6 +2488,7 @@ __owur int SSL_get_conn_close_info(SSL *ssl,
 #define SSL_VALUE_STREAM_WRITE_BUF_SIZE 7
 #define SSL_VALUE_STREAM_WRITE_BUF_USED 8
 #define SSL_VALUE_STREAM_WRITE_BUF_AVAIL 9
+#define SSL_VALUE_QUIC_MAX_PENDING_CONNS 16
 
 #define SSL_VALUE_EVENT_HANDLING_MODE_INHERIT 0
 #define SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT 1
@@ -2735,8 +2736,18 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_OTHER_SIGALG (5 << 16)
 #define SSL_SECOP_OTHER_CERT (6 << 16)
 
-/* Indicated operation refers to peer key or certificate */
+/*
+ * Unused values - these do nothing and are never set.
+ * They are retained because of API. They should
+ * be removed next major
+ */
 #define SSL_SECOP_PEER 0x1000
+/* Peer EE key in certificate */
+#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
+/* Peer CA key in certificate */
+#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
+/* Peer CA digest algorithm in certificate */
+#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 /* Values for "op" parameter in security callback */
 
@@ -2775,12 +2786,6 @@ const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);
 #define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT)
 /* CA digest algorithm in certificate */
 #define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT)
-/* Peer EE key in certificate */
-#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)
-/* Peer CA key in certificate */
-#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
-/* Peer CA digest algorithm in certificate */
-#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
 
 void SSL_set_security_level(SSL *s, int level);
 __owur int SSL_get_security_level(const SSL *s);