node-linux-arm64 25.8.0 → 25.8.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +96 -0
  2. package/README.md +2 -0
  3. package/bin/node +0 -0
  4. package/include/node/common.gypi +1 -1
  5. package/include/node/node_version.h +1 -1
  6. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -8,6 +8,8 @@
8
8
  </tr>
9
9
  <tr>
10
10
  <td>
11
+ <a href="#25.8.2">25.8.2</a><br/>
12
+ <a href="#25.8.1">25.8.1</a><br/>
11
13
  <a href="#25.8.0">25.8.0</a><br/>
12
14
  <a href="#25.7.0">25.7.0</a><br/>
13
15
  <a href="#25.6.1">25.6.1</a><br/>
@@ -50,6 +52,100 @@
50
52
  * [io.js](CHANGELOG_IOJS.md)
51
53
  * [Archive](CHANGELOG_ARCHIVE.md)
52
54
 
55
+ <a id="25.8.2"></a>
56
+
57
+ ## 2026-03-24, Version 25.8.2 (Current), @RafaelGSS
58
+
59
+ This is a security release.
60
+
61
+ ### Notable Changes
62
+
63
+ * (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
64
+ * (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
65
+ * (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium
66
+ * (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
67
+ * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
68
+ * (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
69
+ * (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
70
+ * (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
71
+ * (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low
72
+
73
+ ### Commits
74
+
75
+ * \[[`2086b7477b`](https://github.com/nodejs/node/commit/2086b7477b)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834)
76
+ * \[[`0f9332a40a`](https://github.com/nodejs/node/commit/0f9332a40a)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
77
+ * \[[`2b6937ddb2`](https://github.com/nodejs/node/commit/2b6937ddb2)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](https://github.com/nodejs/node/pull/62271)
78
+ * \[[`bfb8ad5787`](https://github.com/nodejs/node/commit/bfb8ad5787)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](https://github.com/nodejs/node/pull/62233)
79
+ * \[[`be6384727f`](https://github.com/nodejs/node/commit/be6384727f)] - **deps**: upgrade npm to 11.11.1 (npm team) [#62216](https://github.com/nodejs/node/pull/62216)
80
+ * \[[`2feea5bb97`](https://github.com/nodejs/node/commit/2feea5bb97)] - **deps**: V8: override `depot_tools` version (Richard Lau) [#62344](https://github.com/nodejs/node/pull/62344)
81
+ * \[[`86c04784dd`](https://github.com/nodejs/node/commit/86c04784dd)] - **(CVE-2026-21710)** **http**: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://github.com/nodejs-private/node-private/pull/821)
82
+ * \[[`5197a56a34`](https://github.com/nodejs/node/commit/5197a56a34)] - **(CVE-2026-21711)** **permission**: include permission check to pipe\_wrap.cc (RafaelGSS) [nodejs-private/node-private#820](https://github.com/nodejs-private/node-private/pull/820)
83
+ * \[[`04a886c735`](https://github.com/nodejs/node/commit/04a886c735)] - **(CVE-2026-21716)** **permission**: include permission check on lib/fs/promises (RafaelGSS) [nodejs-private/node-private#795](https://github.com/nodejs-private/node-private/pull/795)
84
+ * \[[`9a7f80f2b0`](https://github.com/nodejs/node/commit/9a7f80f2b0)] - **(CVE-2026-21715)** **permission**: add permission check to realpath.native (RafaelGSS) [nodejs-private/node-private#794](https://github.com/nodejs-private/node-private/pull/794)
85
+ * \[[`d9c9b628cf`](https://github.com/nodejs/node/commit/d9c9b628cf)] - **(CVE-2026-21714)** **src**: handle NGHTTP2\_ERR\_FLOW\_CONTROL error code (RafaelGSS) [nodejs-private/node-private#832](https://github.com/nodejs-private/node-private/pull/832)
86
+ * \[[`45b55dc786`](https://github.com/nodejs/node/commit/45b55dc786)] - **(CVE-2026-21712)** **src**: handle url crash on different url formats (RafaelGSS) [nodejs-private/node-private#816](https://github.com/nodejs-private/node-private/pull/816)
87
+ * \[[`4bfda307c0`](https://github.com/nodejs/node/commit/4bfda307c0)] - **(CVE-2026-21637)** **tls**: wrap SNICallback invocation in try/catch (Matteo Collina) [nodejs-private/node-private#819](https://github.com/nodejs-private/node-private/pull/819)
88
+
89
+ <a id="25.8.1"></a>
90
+
91
+ ## 2026-03-11, Version 25.8.1 (Current), @aduh95
92
+
93
+ ### Notable Changes
94
+
95
+ * \[[`ea87eea71a`](https://github.com/nodejs/node/commit/ea87eea71a)] - **module**: fix extensionless CJS files in `"type": "module"` packages (Matteo Collina) [#62083](https://github.com/nodejs/node/pull/62083)
96
+
97
+ ### Commits
98
+
99
+ * \[[`bab750d1b3`](https://github.com/nodejs/node/commit/bab750d1b3)] - **build**: do not depend on V8 deps on `--without-bundled-v8` builds (Antoine du Hamel) [#62033](https://github.com/nodejs/node/pull/62033)
100
+ * \[[`b26d1c7fcb`](https://github.com/nodejs/node/commit/b26d1c7fcb)] - **crypto**: make --use-system-ca per-env rather than per-process (Aditi) [#60678](https://github.com/nodejs/node/pull/60678)
101
+ * \[[`e362635abf`](https://github.com/nodejs/node/commit/e362635abf)] - **crypto**: add missing AES dictionaries (Filip Skokan) [#62099](https://github.com/nodejs/node/pull/62099)
102
+ * \[[`6f975db8af`](https://github.com/nodejs/node/commit/6f975db8af)] - **crypto**: fix importKey required argument count check (Filip Skokan) [#62099](https://github.com/nodejs/node/pull/62099)
103
+ * \[[`3beaf9c5fc`](https://github.com/nodejs/node/commit/3beaf9c5fc)] - **deps**: update amaro to 1.1.8 (Node.js GitHub Bot) [#62151](https://github.com/nodejs/node/pull/62151)
104
+ * \[[`53afb0edd8`](https://github.com/nodejs/node/commit/53afb0edd8)] - **deps**: update sqlite to 3.52.0 (Node.js GitHub Bot) [#62150](https://github.com/nodejs/node/pull/62150)
105
+ * \[[`a13ed052a1`](https://github.com/nodejs/node/commit/a13ed052a1)] - **deps**: update merve to 1.2.0 (Node.js GitHub Bot) [#62149](https://github.com/nodejs/node/pull/62149)
106
+ * \[[`2c850577b7`](https://github.com/nodejs/node/commit/2c850577b7)] - **deps**: patch resb crate (Richard Lau) [#62138](https://github.com/nodejs/node/pull/62138)
107
+ * \[[`37862a6728`](https://github.com/nodejs/node/commit/37862a6728)] - **deps**: V8: cherry-pick aa0b288f87cc (Richard Lau) [#62136](https://github.com/nodejs/node/pull/62136)
108
+ * \[[`09191ad8b4`](https://github.com/nodejs/node/commit/09191ad8b4)] - **deps**: update ada to 3.4.3 (Node.js GitHub Bot) [#62049](https://github.com/nodejs/node/pull/62049)
109
+ * \[[`8d63a178fd`](https://github.com/nodejs/node/commit/8d63a178fd)] - **doc**: copyedit `addons.md` (Antoine du Hamel) [#62071](https://github.com/nodejs/node/pull/62071)
110
+ * \[[`83719ffb64`](https://github.com/nodejs/node/commit/83719ffb64)] - **doc**: correct `util.convertProcessSignalToExitCode` validation behavior (René) [#62134](https://github.com/nodejs/node/pull/62134)
111
+ * \[[`eeee7c7fb1`](https://github.com/nodejs/node/commit/eeee7c7fb1)] - **doc**: add efekrskl as triager (Efe) [#61876](https://github.com/nodejs/node/pull/61876)
112
+ * \[[`db150b2e69`](https://github.com/nodejs/node/commit/db150b2e69)] - **doc**: fix markdown for `expectFailure` values (Jacob Smith) [#62100](https://github.com/nodejs/node/pull/62100)
113
+ * \[[`d55a441e60`](https://github.com/nodejs/node/commit/d55a441e60)] - **doc**: add title to index (Aviv Keller) [#62046](https://github.com/nodejs/node/pull/62046)
114
+ * \[[`cc46204b48`](https://github.com/nodejs/node/commit/cc46204b48)] - **doc**: include url.resolve() in DEP0169 application deprecation (Mike McCready) [#62002](https://github.com/nodejs/node/pull/62002)
115
+ * \[[`1d91a7261e`](https://github.com/nodejs/node/commit/1d91a7261e)] - **doc,module**: add missing doc for syncHooks.deregister() (Joyee Cheung) [#61959](https://github.com/nodejs/node/pull/61959)
116
+ * \[[`5198573bee`](https://github.com/nodejs/node/commit/5198573bee)] - **http**: fix use-after-free when freeParser is called during llhttp\_execute (Gerhard Stöbich) [#62095](https://github.com/nodejs/node/pull/62095)
117
+ * \[[`f8793f80df`](https://github.com/nodejs/node/commit/f8793f80df)] - **lib**: fix source map url parse in dynamic imports (Chengzhong Wu) [#61990](https://github.com/nodejs/node/pull/61990)
118
+ * \[[`5439d0e0cf`](https://github.com/nodejs/node/commit/5439d0e0cf)] - **meta**: bump actions/download-artifact from 7.0.0 to 8.0.0 (dependabot\[bot]) [#62063](https://github.com/nodejs/node/pull/62063)
119
+ * \[[`27fd21943a`](https://github.com/nodejs/node/commit/27fd21943a)] - **meta**: bump actions/upload-artifact from 6.0.0 to 7.0.0 (dependabot\[bot]) [#62062](https://github.com/nodejs/node/pull/62062)
120
+ * \[[`5b266f3295`](https://github.com/nodejs/node/commit/5b266f3295)] - **meta**: bump step-security/harden-runner from 2.14.2 to 2.15.0 (dependabot\[bot]) [#62064](https://github.com/nodejs/node/pull/62064)
121
+ * \[[`ea87eea71a`](https://github.com/nodejs/node/commit/ea87eea71a)] - **module**: fix extensionless CJS files in `"type": "module"` packages (Matteo Collina) [#62083](https://github.com/nodejs/node/pull/62083)
122
+ * \[[`851228cd60`](https://github.com/nodejs/node/commit/851228cd60)] - **sqlite**: handle stmt invalidation (Guilherme Araújo) [#61877](https://github.com/nodejs/node/pull/61877)
123
+ * \[[`19efe60548`](https://github.com/nodejs/node/commit/19efe60548)] - **src**: expose async context frame debugging helper to JS (Anna Henningsen) [#62103](https://github.com/nodejs/node/pull/62103)
124
+ * \[[`0257e8072f`](https://github.com/nodejs/node/commit/0257e8072f)] - **src**: make AsyncWrap subclass internal field counts explicit (Anna Henningsen) [#62103](https://github.com/nodejs/node/pull/62103)
125
+ * \[[`975dafbe3b`](https://github.com/nodejs/node/commit/975dafbe3b)] - **src**: release context frame in AsyncWrap::EmitDestroy (Gerhard Stöbich) [#61995](https://github.com/nodejs/node/pull/61995)
126
+ * \[[`f2c08c7888`](https://github.com/nodejs/node/commit/f2c08c7888)] - **src**: use validate\_ascii\_with\_errors instead of validate\_ascii (Сковорода Никита Андреевич) [#61122](https://github.com/nodejs/node/pull/61122)
127
+ * \[[`0278461d83`](https://github.com/nodejs/node/commit/0278461d83)] - **stream**: optimize webstreams pipeTo (Mattias Buelens) [#62079](https://github.com/nodejs/node/pull/62079)
128
+ * \[[`4d62e95bfa`](https://github.com/nodejs/node/commit/4d62e95bfa)] - **stream**: fix brotli error handling in web compression streams (Filip Skokan) [#62107](https://github.com/nodejs/node/pull/62107)
129
+ * \[[`4bdcaf2865`](https://github.com/nodejs/node/commit/4bdcaf2865)] - **stream**: improve Web Compression spec compliance (Filip Skokan) [#62107](https://github.com/nodejs/node/pull/62107)
130
+ * \[[`a5b1be2045`](https://github.com/nodejs/node/commit/a5b1be2045)] - **stream**: fix UTF-8 character corruption in fast-utf8-stream (Matteo Collina) [#61745](https://github.com/nodejs/node/pull/61745)
131
+ * \[[`5632446c4e`](https://github.com/nodejs/node/commit/5632446c4e)] - **stream**: fix TransformStream race on cancel with pending write (Marco) [#62040](https://github.com/nodejs/node/pull/62040)
132
+ * \[[`f90fa9cd1a`](https://github.com/nodejs/node/commit/f90fa9cd1a)] - **stream**: accept ArrayBuffer in CompressionStream and DecompressionStream (조수민) [#61913](https://github.com/nodejs/node/pull/61913)
133
+ * \[[`00319eaa3a`](https://github.com/nodejs/node/commit/00319eaa3a)] - **test**: update WPT for url to c928b19ab0 (Node.js GitHub Bot) [#62148](https://github.com/nodejs/node/pull/62148)
134
+ * \[[`456abc7d20`](https://github.com/nodejs/node/commit/456abc7d20)] - **test**: update WPT for WebCryptoAPI to c9e955840a (Node.js GitHub Bot) [#62147](https://github.com/nodejs/node/pull/62147)
135
+ * \[[`82770cb7d3`](https://github.com/nodejs/node/commit/82770cb7d3)] - **test**: improve WPT report runner (Filip Skokan) [#62107](https://github.com/nodejs/node/pull/62107)
136
+ * \[[`cfc847d233`](https://github.com/nodejs/node/commit/cfc847d233)] - **test**: update WPT compression to ae05f5cb53 (Filip Skokan) [#62107](https://github.com/nodejs/node/pull/62107)
137
+ * \[[`80f78f2737`](https://github.com/nodejs/node/commit/80f78f2737)] - **test**: update WPT for WebCryptoAPI to 42e47329fd (Node.js GitHub Bot) [#62048](https://github.com/nodejs/node/pull/62048)
138
+ * \[[`8048e0508c`](https://github.com/nodejs/node/commit/8048e0508c)] - **test**: fix skipping behavior for `test-runner-run-files-undefined` (Antoine du Hamel) [#62026](https://github.com/nodejs/node/pull/62026)
139
+ * \[[`699a6214c6`](https://github.com/nodejs/node/commit/699a6214c6)] - **tools**: revert timezone update GHA workflow to ubuntu-latest (Richard Lau) [#62140](https://github.com/nodejs/node/pull/62140)
140
+ * \[[`1a453b550c`](https://github.com/nodejs/node/commit/1a453b550c)] - **tools**: improve error handling in test426 update script (Rich Trott) [#62121](https://github.com/nodejs/node/pull/62121)
141
+ * \[[`710dde5ee2`](https://github.com/nodejs/node/commit/710dde5ee2)] - **tools**: fix `--node-builtin-modules-path` value in `shell.nix` (Antoine du Hamel) [#62102](https://github.com/nodejs/node/pull/62102)
142
+ * \[[`dcb1cbb21f`](https://github.com/nodejs/node/commit/dcb1cbb21f)] - **tools**: bump the eslint group across 1 directory with 2 updates (dependabot\[bot]) [#62092](https://github.com/nodejs/node/pull/62092)
143
+ * \[[`7d0b758583`](https://github.com/nodejs/node/commit/7d0b758583)] - **tools**: fix daily wpt workflow nighly release version lookup (Filip Skokan) [#62076](https://github.com/nodejs/node/pull/62076)
144
+ * \[[`3e8c816f2e`](https://github.com/nodejs/node/commit/3e8c816f2e)] - **tools**: fix example in release proposal linter (Richard Lau) [#62074](https://github.com/nodejs/node/pull/62074)
145
+ * \[[`772d3d270d`](https://github.com/nodejs/node/commit/772d3d270d)] - **tools**: bump minimatch from 3.1.3 to 3.1.5 in /tools/clang-format (dependabot\[bot]) [#62013](https://github.com/nodejs/node/pull/62013)
146
+ * \[[`92f3b42672`](https://github.com/nodejs/node/commit/92f3b42672)] - **tools**: bump eslint to v10, babel to v8.0.0-rc.2 (Huáng Jùnliàng) [#61905](https://github.com/nodejs/node/pull/61905)
147
+ * \[[`deead95ec5`](https://github.com/nodejs/node/commit/deead95ec5)] - **url**: suppress warnings from url.format/url.resolve inside node\_modules (René) [#62005](https://github.com/nodejs/node/pull/62005)
148
+
53
149
  <a id="25.8.0"></a>
54
150
 
55
151
  ## 2026-03-03, Version 25.8.0 (Current), @richardlau
package/README.md CHANGED
@@ -757,6 +757,8 @@ maintaining the Node.js project.
757
757
  **Oliver Medhurst** <<honk@goose.icu>> (they/them)
758
758
  * [daeyeon](https://github.com/daeyeon) -
759
759
  **Daeyeon Jeong** <<daeyeon.dev@gmail.com>> (he/him)
760
+ * [efekrskl](https://github.com/efekrskl) -
761
+ **Efe Karasakal** <<hi@efe.dev>> (he/him)
760
762
  * [gireeshpunathil](https://github.com/gireeshpunathil) -
761
763
  **Gireesh Punathil** <<gpunathi@in.ibm.com>> (he/him)
762
764
  * [gurgunday](https://github.com/gurgunday) -
package/bin/node CHANGED
Binary file
package/include/node/common.gypi CHANGED
@@ -38,7 +38,7 @@
38
38
 
39
39
  # Reset this number to 0 on major V8 upgrades.
40
40
  # Increment by one for each non-official patch applied to deps/v8.
41
- 'v8_embedder_string': '-node.20',
41
+ 'v8_embedder_string': '-node.24',
42
42
 
43
43
  ##### V8 defaults for Node.js #####
44
44
 
package/include/node/node_version.h CHANGED
@@ -24,7 +24,7 @@
24
24
 
25
25
  #define NODE_MAJOR_VERSION 25
26
26
  #define NODE_MINOR_VERSION 8
27
- #define NODE_PATCH_VERSION 0
27
+ #define NODE_PATCH_VERSION 2
28
28
 
29
29
  #define NODE_VERSION_IS_LTS 0
30
30
  #define NODE_VERSION_LTS_CODENAME ""
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node-linux-arm64",
3
- "version": "25.8.0",
3
+ "version": "25.8.2",
4
4
  "description": "node",
5
5
  "repository": {
6
6
  "url": "git+https://github.com/aredridel/node-bin-gen.git"