[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@nuxtjs/critters	^0.9.2 → ^0.10.1			dependencies	minor
@playwright/test (source)	1.60.0 → 1.64.1			dependencies	minor
MatteoGabriele/agentscan-action	v2.0.1 → v2.5.0			action	minor
danielroe/provenance-action	v0.1.1 → v0.2.0			action	minor
node (source)	^24.0.0 → ^24.22.2			devEngines.runtime	minor
pnpm (source)	12.3.4 → 12.16.1			devEngines.packageManager	minor

---

Release Notes

nuxt-modules/critters (@​nuxtjs/critters)

v0.10.1

Compare Source

v0.10.1 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• inline beasties runtime into the server bundle (03f3ec8)

❤️ Contributors

• Daniel Roe (@​danielroe)

v0.10.0

Compare Source

v0.10.0 is the next major release.

👉 Changelog

compare changes

🚀 Enhancements

• ⚠️ use beasties build-time compiler and zero-dependency runtime (#​702)

🤖 CI

• add explicit permissions (fd9b88f)
• add agent-scan workflow to flag bot-authored PRs (ced5dc5)

❤️ Contributors

• Daniel Roe (@​danielroe)

microsoft/playwright (@​playwright/test)

v1.64.1

Compare Source

Bug Fixes

• #​43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #​43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #​333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});

• New fps option in testOptions.video, recordVideo and
  screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
• New style option takes CSS declarations for the point marker, the target
  highlight and the action title. It replaces the fontSize option, which is now deprecated.
• The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
• Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
  quality.
• All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

• New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

  // playwright.config.ts
  import { defineConfig, devices } from '@playwright/test';
  
  export default defineConfig({
    projects: [
      { name: 'chromium', use: devices['Desktop Chrome'] },
      { name: 'firefox', use: devices['Desktop Firefox'], default: false },
      { name: 'webkit', use: devices['Desktop Safari'], default: false },
    ],
  });

  npx playwright test                     # runs chromium only
  npx playwright test --project=firefox   # runs firefox
  npx playwright test --project="*"       # runs all three, for example on CI

• New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

  npx playwright test --shuffle
  # Running 42 tests using 4 workers, shuffle seed 271828182
  # ...
  
  # Pass the seed to reproduce the same order.
  npx playwright test --shuffle 271828182

• New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

  test.describe.configure({ lock: 'user-settings' });

• New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

  // playwright.config.ts
  export default defineConfig({
    expect: {
      toHaveScreenshot: { type: 'webp' },
    },
  });

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

• New page.getByRef() locates an element by its aria ref, such as e2, reported by page.ariaSnapshot() in the 'ai' mode.

• New option includeShadow in page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.

• New option signCount sets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the current signCount, and it is saved and restored together with the credentials in the storage state.

• New fullConfig.filteredProjects lists the projects that were selected to run after applying the --project filter. It is available in global setup and reporters.

• New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:

  await request.addCookies([{ name: 'session-id', value: '42', url: 'https://example.com' }]);
  console.log(await request.cookies('https://example.com'));
  await request.clearCookies({ name: 'session-id' });

Breaking changes ⚠️

• screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

  // playwright.config.ts
  export default defineConfig({
    use: {
      ...devices['Desktop Chrome'],
      screen: undefined,
    },
  });

• JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

• --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

• Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

• Chromium 156.0.8078.4
• Mozilla Firefox 157.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 155
• Microsoft Edge 155

v1.63.0

Compare Source

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example, Click with subtitle getByRole('button').
Both are rendered next to the step title in the trace viewer and the HTML report.

🖼️ Aria and screen snapshots in traces

The snapshots option of tracing.start() and the testOptions.trace fixture option now accept an
object selecting what to capture on every action:

// playwright.config.ts
export default defineConfig({
  use: {
    trace: {
      mode: 'on',
      snapshots: { dom: true, aria: true, screen: true }
    },
  },
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

• httpCredentials now also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.
• New option opfs includes the origin private file system in the storage state, so it can be persisted and restored into later contexts.
• New events page.on('dialogclosed') and browserContext.on('dialogclosed') are emitted when a JavaScript dialog is accepted, dismissed or closed by the user.

Locators

• New locator.ariaSnapshotJSON() and page.ariaSnapshotJSON() return the aria snapshot as a JSON value instead of YAML markup, with mode, depth and boxes options.
• apiRequestContext.get() and other request methods accept a type argument that types the response json():

const response = await request.get<User>('/api/users/42');
const user = await response.json(); // typed as User

Test runner

• New standalone testOptions.reducedMotion, testOptions.forcedColors and testOptions.contrast options.
• New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config, instead of replacing them like --reporter does.
• New omitTags option for the list, line, dot, github and junit reporters suppresses the tags that are automatically appended to test titles.

Command line

• npx playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
• npx playwright codegen --http-credentials records against pages behind HTTP authentication.

Miscellaneous

• New built-in perfetto reporter writes a Trace Event Format file for the Perfetto UI or chrome://tracing, rendering the test run as a timeline with a lane per worker.
• The HTML report renders a duration waterfall next to test steps.

Announcements

• ⚠️ The experimental @playwright/experimental-ct-react, @playwright/experimental-ct-react17 and @playwright/experimental-ct-vue packages will no longer be updated. Follow the migration guide to move to the stories model introduced in 1.62. Story ids passed to fixtures.mount() can now be typed through the generated Stories registry.
• ⚠️ Ubuntu 20.04 is not supported anymore.
• 🐧 On Linux arm64, Playwright now downloads the Chrome for Testing build of Chromium, the same build used on all other platforms.

Browser Versions

• Chromium 153.0.8010.12
• Mozilla Firefox 155.0
• WebKit 26.6

This version was also tested against the following stable channels:

• Google Chrome 153
• Microsoft Edge 153

v1.62.1

Compare Source

Bug Fixes

• #​41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #​41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #​41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #​42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #​42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

v1.61.1

Compare Source

Bug Fixes

• #​41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #​41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #​41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #​41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #​41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
• New -G command line shorthand for --grep-invert.

🛠️ Other improvements

• Playwright now supports Ubuntu 26.04.
• HAR and trace recordings now include WebSocket requests.

Browser Versions

• Chromium 149.0.7827.55
• Mozilla Firefox 151.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 149
• Microsoft Edge 149

MatteoGabriele/agentscan-action

v2.5.0

Compare Source

Identity update:

• fix(detectors): branch pr automation flag

Full Changelog: MatteoGabriele/agentscan-action@v2.4.0...v2.5.0

v2.4.0

Compare Source

What's Changed

• feat: make github-token optional by @​bluwy in #​35

New Contributors

• @​bluwy made their first contribution in #​35

Full Changelog: MatteoGabriele/agentscan-action@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed

• feat: add honeypot by @​MatteoGabriele in #​34

Full Changelog: MatteoGabriele/agentscan-action@v2.2.0...v2.3.0

v2.2.0

Compare Source

What's Changed

• refactor(evidence): remove redundant copy by @​MatteoGabriele in #​33

Full Changelog: MatteoGabriele/agentscan-action@v2.1.0...v2.2.0

v2.1.0

Compare Source

What's Changed

• feat: add evidence on comments by @​MatteoGabriele in #​32

Full Changelog: MatteoGabriele/agentscan-action@v2.0.1...v2.1.0

danielroe/provenance-action

v0.2.0

Compare Source

compare changes

🚀 Enhancements

• Respect pnpm's trustPolicyExclude (2f0f52d)
• Detect loss of npm staged publishing approval (fc86c9a)

📖 Documentation

• Update action description (e78b179)
• Add link to pnpm v10.21 trustPolicy 🎉 (fd8dd3c)

🏡 Chore

• Add licence (cafd196)
• Revert pnpm trust policy and restore provenance action (4320fb9)
• Release v0.0.2 (194cad5)
• Migrate to pnpm v11 (#​99)

✅ Tests

• Improve coverage of lockfile parsing utils (a9d6553)
• Migrate to vitest (07fa732)
• Add api responses as fixtures + test provenance utils (fd6ed30)

🤖 CI

• Pin github actions to full-length commit shas (9426311)
• Add agent-scan workflow to flag bot-authored PRs (81568f7)

❤️ Contributors

• Daniel Roe (@​danielroe)

nodejs/node (node)

v24.22.2: 2026-10-28, Version 24.22.2 'Krypton' (LTS), @​aduh95

Compare Source

Commits

• [f8bdcd54ed] - deps: V8: backport 786c1c2 (Eliau Elkouby) #​66249
• [3b93fd6b2b] - deps: V8: backport 1a00890 (Jakob Linke) #​65764
• [5aaf62faaa] - deps: V8: backport c9c0abf (Jakob Linke) #​65764
• [3b8eb1a920] - deps: V8: backport ebd1578 (Marja Hölttä) #​65764
• [ab70b5d681] - deps: V8: cherry-pick 853553f (Victor Gomes) #​66241
• [17ec999f24] - stream: keep async context of parked writes (Matteo Collina) #​66907

v24.22.1: 2026-10-21, Version 24.22.1 'Krypton' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
• (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• deps: update timezone to 2026e (Node.js GitHub Bot)
• deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
• deps: update undici to 7.30.1 (Node.js GitHub Bot)

Commits

• [2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #​66877
• [4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007
• [9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #​66496
• [1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #​66868
• [49dff6f57a] - deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [fca511adc5] - deps: V8: backport 93cd21e (Joyee Cheung) nodejs-private/node-private#1008
• [18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #​66419
• [fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #​66333
• [b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #​66396
• [ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #​66396
• [1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #​66764
• [843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [b5f41529df] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #​66871
• [935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #​66855

v24.22.0: 2026-10-14, Version 24.22.0 'Krypton' (LTS), @​richardlau prepared by @​aduh95

Compare Source

Notable Changes

• [ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #​65627
• [c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #​65553
• [a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #​65484
• [c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #​65484
• [51aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #​63411
• [d11c65d2f2] - doc: add araujogui to collaborators (Guilherme Araújo) #​66090
• [acc1578179] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #​65593
• [a7f8de6362] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #​64725
• [60c3eb61bd] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #​65825
• [6b3e6f9d5c] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #​65806
• [75456a3512] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #​65606
• [72d1b40c56] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #​65434
• [41161dda87] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #​64232
• [adbc757d70] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #​64232
• [241339f072] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #​65805
• [63b0974d9e] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #​65899
• [a3bbb5a26f] - (SEMVER-MINOR) util: implement debounce (James M Snell) #​65899

Commits

• [e6832b2cb1] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #​64449
• [a079177d9f] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #​65922
• [10b1a0f70f] - benchmark: fix max-regressions detection in compare.js (James M Snell) #​65587
• [e0c7ba8ad5] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #​65594
• [21fed10bb0] - benchmark: add crypto class benchmarks (Filip Skokan) #​65518
• [fa912242b7] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #​65905
• [a6bd0c1413] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #​66023
• [94e12139ee] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #​65744
• [7a2f322943] - build: fix quiet default for make builds (Shelley Vohr) #​65826
• [c280d650b0] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #​65797
• [4b23a4472c] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #​62237
• [676e15c003] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #​65464
• [f784058482] - build: remove obsolete configure flags (Chengzhong Wu) #​65456
• [f63f37d243] - build: activate correct default flags for riscv64 (Stewart X Addison) #​65708
• [da46ac075d] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #​65491
• [249e9a16dd] - build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY (Piotr Kubaj) #​66082
• [146f00f64b] - child_process: clear timeout timer on spawn-time error too (kishore280) #​65506
• [13987f4418] - crypto: remove redundent std::move call (Antoine du Hamel) #​66111
• [ef957ac85f] - crypto: skip private RSA parameters in key details (Filip Skokan) #​66108
• [8feccc5e22] - crypto: use provider EC group names (Filip Skokan) #​66108
• [764e0d1120] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #​66108
• [50ffed1979] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #​66108
• [56c16b2fd6] - crypto: derive keys through EVP_KDF (Filip Skokan) #​66108
• [a4effe6809] - crypto: use names for asymmetric key algorithms (Filip Skokan) #​65966
• [ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #​65627
• [[8e631aa48f](https://redirect.github.com/nodejs/node

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nuxt.new	Ready	Preview	Oct 28, 2026 9:34pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​nuxtjs/​critters@​0.9.2 ⏵ 0.10.1			+6	+3
	@​playwright/​test@​1.60.0 ⏵ 1.64.1

View full report