Update all

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@rollup/plugin-babel (source)	6.0.4 → 6.1.0			devDependencies	minor
@rollup/plugin-replace (source)	6.0.2 → 6.0.3			devDependencies	patch
@types/node (source)	18.19.112 → 18.19.130			devDependencies	patch
acorn	8.15.0 → 8.19.0			devDependencies	minor
acorn-walk	8.3.4 → 8.3.5			devDependencies	patch
ava (source)	6.4.0 → 6.4.1			devDependencies	patch
babel-loader	9.1.3 → 9.2.1			devDependencies	minor
css-loader	6.10.0 → 6.11.0			devDependencies	minor
magic-string	0.30.17 → 0.30.21			devDependencies	patch
mini-css-extract-plugin	2.8.1 → 2.10.2			devDependencies	minor
node (source)	22.16.0 → 22.23.3			volta	minor
np	10.2.0 → 10.3.0			devDependencies	minor
preact (source)	10.19.6 → 10.29.8			dependencies	minor
prettier (source)	3.2.5 → 3.9.10			devDependencies	minor
prettier (source)	3.6.0 → 3.9.10			devDependencies	minor
rimraf	5.0.5 → 5.0.10			devDependencies	patch
shx	0.3.4 → 0.4.0			devDependencies	minor
sinon (source)	21.0.0 → 21.1.2			devDependencies	minor
sirv	3.0.1 → 3.0.2			devDependencies	patch
typescript (source)	5.8.3 → 5.9.3			devDependencies	minor

---

Release Notes

rollup/plugins (@​rollup/plugin-babel)

v6.1.0

2025-10-13

Features

• feat: allow excluding manual chunks when transforming generated code (#​1906)

rollup/plugins (@​rollup/plugin-replace)

v6.0.3

2025-10-29

Bugfixes

• fix: update delimiters to respect valid js identifier chars (#​1938)

acornjs/acorn (acorn)

v8.19.0

Compare Source

v8.18.0

Compare Source

v8.17.0

Compare Source

v8.16.0

Compare Source

avajs/ava (ava)

v6.4.1

Compare Source

What's Changed

• Keep test worker alive until explicitly freed by @​matz3 in #​3391

New Contributors

• @​matz3 made their first contribution in #​3391

Full Changelog: avajs/ava@v6.4.0...v6.4.1

babel/babel-loader (babel-loader)

v9.2.1

Compare Source

What's Changed

• Avoid error on missing getLogger by @​nicolo-ribaudo in #​1045

Full Changelog: babel/babel-loader@v9.2.0...v9.2.1

v9.2.0

Compare Source

What's Changed

• Remove caller option check by @​JLHwung in #​1007
• Update deps by @​JLHwung in #​1025
• docs: clarify that cacheIdentifier is computed from the merged options by @​JLHwung in #​1000
• Add babel-loader logger by @​JLHwung in #​1037

Full Changelog: babel/babel-loader@v9.1.3...v9.2.0

webpack/css-loader (css-loader)

v6.11.0

Compare Source

Features

• supports multiple composes (#​1582) (bbca614)

Bug Fixes

• do not break @scope at-rule without params (#​1581) (e022e3b)

Rich-Harris/magic-string (magic-string)

v0.30.21

Compare Source

v0.30.19

Compare Source

Bug Fixes

• this.outro need to be mapped (#​300) (8852c8d)

Features

• replace(All) support replacement for functions when the first parameter is a string (#​304) (fd1d887)

v0.30.18

Compare Source

Bug Fixes

• prevent infinite loop on empty input (#​302) (0fd6253)

webpack/mini-css-extract-plugin (mini-css-extract-plugin)

v2.10.2

Compare Source

v2.10.1

Compare Source

v2.10.0

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

v2.9.4

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

v2.9.3

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

v2.9.2

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

v2.9.1

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

v2.9.0

Compare Source

Features

• respect output.cssFilename and output.cssChunkFilename (#​1151) (54f775d)

Bug Fixes

• prevent generation of a contentHash for a chunk when the set of css modules is of size 0 (#​1154) (4e4a95d)

2.9.4 (2025-08-11)

Bug Fixes

• hmr crash in some situations (#​1140) (f67c05a)

2.9.3 (2025-08-04)

Bug Fixes

• should update initial chunks correctly with filename (dab023f)

2.9.2 (2024-11-01)

Bug Fixes

• prefetch and preload runtime generation (#​1116) (58c6b74)

2.9.1 (2024-08-19)

Bug Fixes

• add export default {} when CSS modules enabled and a file is empty for the defaultExport option (8f77e19)

nodejs/node (node)

v22.23.3: 2026-09-23, Version 22.23.3 'Jod' (LTS), @​aduh95 prepared by @​juanarbol

Compare Source

Notable Changes

• [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #​64746
• [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #​65653
• [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #​64884
• [e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #​62324
• [a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #​65542
• [2a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #​65790
• [3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #​62710
• [66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #​62623

Commits

• [44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #​65282
• [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #​64746
• [71feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #​63527
• [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #​65653
• [2a3548e51c] - deps: update undici to 6.28.1 (mcollina) #​65790
• [59d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #​65542
• [a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #​65542
• [3376e27de2] - deps: V8: cherry-pick a6eaf75 (Camillo Bruni) #​65402
• [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #​64884
• [4e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #​64588
• [7d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #​64330
• [01855a19d3] - deps: c-ares: cherry-pick 8ba37af (René) #​64110
• [23fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #​63375
• [5286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #​62810
• [6d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #​62962
• [e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #​62324
• [d9cb8468a3] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #​63515
• [c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #​64193
• [37f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #​62835
• [7c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #​64166
• [3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #​62710
• [66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #​62623
• [ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #​65217
• [839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #​65629
• [40eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #​65542
• [75098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #​63065
• [08b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #​62627
• [02cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #​62993
• [6f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #​64753
• [bc5753d438] - tools: remove envinfo from our workflows (Antoine du Hamel) #​64259
• [d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #​64070
• [38ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #​63938
• [fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #​63110
• [e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #​62961
• [5fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #​64651
• [ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #​65108

v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 6.28.0 (Node.js GitHub Bot)

Commits

• [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #​64714
• [22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932
• [daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #​63752
• [51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934
• [acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

• [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #​63940
• [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #​64004

v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

• [38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
• [ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
• [ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #​63711
• [a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #​62891
• [0f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #​62891
• [38c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #​61136
• [290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #​59790
• [c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #​58786
• [60890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #​57269
• [5024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #​63820
• [7f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #​63820
• [ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #​62656
• [5763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #​63045
• [c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
• [0a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
• [c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
• [0c37bff2ff] - http2: fix DEP0194 message (KaKa) #​58669
• [ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #​58293
• [9b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
• [28dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
• [2f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
• [1662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
• [718d5d0e2c] - test: skip test-fs-utimes-y2K38 on armv7 (Richard Lau) #​63836
• [041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #​62238
• [fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
• [39d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
• [2197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Compare Source

Commits

• [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #​61788
• [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #​62485
• [e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #​62164
• [0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #​62382
• [e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #​62256
• [73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #​62151
• [ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #​61730
• [b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #​61603
• [bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #​62150
• [22ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #​61930
• [f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #​61928
• [1a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #​61925
• [d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #​61879
• [3ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #​61834
• [b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #​61827
• [ffda97afd4] - deps: update googletest to 2461743 (Node.js GitHub Bot) #​62484
• [79aa32cf4f] - deps: update googletest to 73a63ea (Node.js GitHub Bot) #​61927
• [b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #​62629
• [3a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #​62629
• [d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #​62463
• [ec11f3c1d5] - deps: V8: backport 85b3900 (Thibaud Michaud) #​62783
• [08609712ed] - deps: V8: backport 1b27e46 (Thibaud Michaud) #​62783
• [dcc60d5ab2] - deps: V8: backport 9997fc0 (Thibaud Michaud) #​62783
• [1d1f4451fb] - deps: V8: cherry-pick b96e40d (Clemens Backes) #​62783
• [[2268567237](https://redirect.github.com/nodejs

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.