Skip to content

ci(deps): update node to v22.20.0

Deniz Raif Durmazrequested to merge
renovate/public-dockerfile into main

This MR contains the following updates:

Package Type Update Change
node final minor 22.13.1-slim -> 22.20.0-slim

Release Notes

nodejs/node (node)

v22.20.0: 2025-09-24, Version 22.20.0 'Jod' (LTS), @​richardlau

Compare Source

Notable Changes
OpenSSL updated to 3.5.2

For official Node.js builds, or builds using the default build configuration, Node.js now bundles OpenSSL 3.5.2. This update allows Node.js 22.x to be supported through to the planned End-of-Life date of 2027-04-30 as the previously bundled OpenSSL 3.0.x goes out of support in September 2026.

This change does not affect third-party builds of Node.js that link to an external OpenSSL (or OpenSSL-compatible) library.

Other notable changes
Commits

v22.19.0: 2025-08-28, Version 22.19.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
  • [8e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #​59276
  • [e592d739c2] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #​59072
  • [cda1dab6e2] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #​58822
  • [1f184513e9] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #​58440
  • [bace73a173] - doc: update the instruction on how to verify releases (Antoine du Hamel) #​59113
  • [fa9a9e9c69] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #​57038
  • [390a9dc20b] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #​59243
  • [c12c5343ad] - lib: docs deprecate _http_* (Sebastian Beltran) #​59293
  • [f57ee3d71f] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #​58087
  • [035da74c31] - (SEMVER-MINOR) process: add threadCpuUsage (Paolo Insogna) #​56467
  • [8e697d1884] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #​59240
Commits

v22.18.0: 2025-07-31, Version 22.18.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
Type stripping is enabled by default

Node.js will be able to execute TypeScript files without additional configuration:

$ echo 'const foo: string = 'World'; console.log(`Hello ${foo}!`);' > file.ts
$ node file.ts
Hello World!

There are some limitations in the supported syntax documented at https://nodejs.org/api/typescript.html#type-stripping.

This feature is experimental and is subject to change. Disable it by passing --no-experimental-strip-types CLI flag.

Contributed by Marco Ippolito in #​56350.

Other notable changes
  • [26f3711228] - (SEMVER-MINOR) deps: update amaro to 1.1.0 (Node.js GitHub Bot) #​56350
  • [d80ef2a71f] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #​58719
  • [8ab24d21c9] - doc: add islandryu to collaborators (Shima Ryuhei) #​58714
  • [430e66b9b8] - (SEMVER-MINOR) esm: implement import.meta.main (Joe) #​57804
  • [62f7926b6a] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #​58490
  • [65f19a00c3] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #​58853
  • [ccca1517f9] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #​58697
  • [48003e87e8] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #​58951
  • [fe4290a0e6] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #​58700
  • [4dc6b4c67a] - (SEMVER-MINOR) watch: add --watch-kill-signal flag (Dario Piotrowicz) #​58719
  • [8dbc6b210f] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #​58385
Commits

v22.17.1: 2025-07-15, Version 22.17.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()
Commits

v22.17.0: 2025-06-24, Version 22.17.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
⚠️ Deprecations
Instantiating node:http classes without new

Constructing classes like IncomingMessage or ServerResponse without the new keyword is now discouraged. This clarifies API expectations and aligns with standard JavaScript behavior. It may warn or error in future versions.

Contributed by Yagiz Nizipli in #​58518.

options.shell = "" in node:child_process

Using an empty string for shell previously had undefined behavior. This change encourages explicit choices (e.g., shell: true or a shell path) and avoids relying on implementation quirks.

Contributed by Antoine du Hamel and Renegade334 #​58564.

HTTP/2 priority signaling

The HTTP/2 prioritization API (e.g., stream.priority) is now deprecated due to poor real-world support. Applications should avoid using priority hints and expect future removal.

Contributed by Matteo Collina and Antoine du Hamel #​58313.

✅ Features graduated to stable
assert.partialDeepStrictEqual()

This method compares only a subset of properties in deep object comparisons, useful for flexible test assertions. Its stabilization means it's now safe for general use and won't change unexpectedly in future releases.

Contributed by Ruben Bridgewater in #​57370.

Miscellaneous
  • dirent.parentPath
  • filehandle.readableWebStream()
  • fs.glob()
  • fs.openAsBlob()
  • node:readline/promises
  • port.hasRef()
  • readable.compose()
  • readable.iterator()
  • readable.readableAborted
  • readable.readableDidRead
  • Duplex.fromWeb()
  • Duplex.toWeb()
  • Readable.fromWeb()
  • Readable.isDisturbed()
  • Readable.toWeb()
  • stream.isErrored()
  • stream.isReadable()
  • URL.createObjectURL()
  • URL.revokeObjectURL()
  • v8.setHeapSnapshotNearHeapLimit()
  • Writable.fromWeb()
  • Writable.toWeb()
  • writable.writableAborted
  • Startup Snapshot API
  • ERR_INPUT_TYPE_NOT_ALLOWED
  • ERR_UNKNOWN_FILE_EXTENSION
  • ERR_UNKNOWN_MODULE_FORMAT
  • ERR_USE_AFTER_CLOSE

Contributed by James M Snell in #​57513 and #​58541.

Semver-minor features
🔧 fs.FileHandle.readableWebStream gets autoClose option

This gives developers explicit control over whether the file descriptor should be closed when the stream ends. Helps avoid subtle resource leaks.

Contributed by James M Snell in #​58548.

🔧 fs.Dir now supports explicit resource management

This improves ergonomics around async iteration of directories. Developers can now manually control when a directory is closed using .close() or with Symbol.asyncDispose.

Contributed by Antoine du Hamel in #​58206.

📊 http2 gains diagnostics channel: http2.server.stream.finish

Adds observability support for when a stream finishes. Useful for logging, monitoring, and debugging HTTP/2 behavior without patching internals.

Contributed by Darshan Sen in #​58560.

🔐 Permissions: implicit allow-fs-read to entrypoint

Node.js permissions model now allows read access to the entry file by default. It makes running permission-restricted apps smoother while preserving security.

Contributed by Rafael Gonzaga in #​58579.

🎨 util.styleText() adds 'none' style

This lets developers remove styling cleanly without hacks. Useful for overriding inherited terminal styles when composing styled strings.

Contributed by James M Snell in #​58437.

🧑‍💻 Community updates
Commits

v22.16.0: 2025-05-21, Version 22.16.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
  • [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #​57857
  • [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #​58102
  • [c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #​57765
  • [e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #​58011
  • [832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #​57610
  • [c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #​57490
  • [5d1230bec0] - (SEMVER-MINOR) src: set default config as node.config.json (Marco Ippolito) #​57171
  • [30bb1ccbb0] - (SEMVER-MINOR) src: create THROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING (Marco Ippolito) #​57016
  • [0350c6f478] - (SEMVER-MINOR) src: add config file support (Marco Ippolito) #​57016
  • [e1d3a9e192] - (SEMVER-MINOR) src: add ExecutionAsyncId getter for any Context (Attila Szegedi) #​57820
  • [0ec912f452] - (SEMVER-MINOR) stream: preserve AsyncLocalStorage context in finished() (Gürgün Dayıoğlu) #​57865
  • [43490c8797] - (SEMVER-MINOR) util: add types.isFloat16Array() (Livia Medeiros) #​57879
  • [dda6ca9172] - (SEMVER-MINOR) worker: add worker.getHeapStatistics() (Matteo Collina) #​57888
Commits

v22.15.1: 2025-05-14, Version 22.15.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • (CVE-2025-23166) fix error handling on async crypto operation
  • (CVE-2025-23165) add missing call to uv_fs_req_cleanup
Commits

v22.15.0: 2025-04-23, Version 22.15.0 'Jod' (LTS), @​UlisesGascon prepared by @​RafaelGSS

Compare Source

Notable Changes
Commits

v22.14.0: 2025-02-11, Version 22.14.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
  • [82a9000e9e] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #​56566
  • [b7fe54fc88] - (SEMVER-MINOR) fs: allow exclude option in globs to accept glob patterns (Daeyeon Jeong) #​56489
  • [3ac92ef607] - (SEMVER-MINOR) lib: add typescript support to STDIN eval (Marco Ippolito) #​56359
  • [1614e8e7bc] - (SEMVER-MINOR) module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX (Marco Ippolito) #​56610
  • [6d6cffa9cc] - (SEMVER-MINOR) module: add findPackageJSON util (Jacob Smith) #​55412
  • [d35333ae18] - (SEMVER-MINOR) process: add process.ref() and process.unref() methods (James M Snell) #​56400
  • [07ff3ddcb5] - (SEMVER-MINOR) sqlite: support TypedArray and DataView in StatementSync (Alex Yang) #​56385
  • [94d3fe1b62] - (SEMVER-MINOR) src: add --disable-sigusr1 to prevent signal i/o thread (Rafael Gonzaga) #​56441
  • [5afffb4415] - (SEMVER-MINOR) src,worker: add isInternalWorker (Carlos Espa) #​56469
  • [697a851fb3] - (SEMVER-MINOR) test_runner: add TestContext.prototype.waitFor() (Colin Ihrig) #​56595
  • [047537b48c] - (SEMVER-MINOR) test_runner: add t.assert.fileSnapshot() (Colin Ihrig) #​56459
  • [926cf84e95] - (SEMVER-MINOR) test_runner: add assert.register() API (Colin Ihrig) #​56434
  • [c658a8afdf] - (SEMVER-MINOR) worker: add eval ts input (Marco Ippolito) #​56394
Commits

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports