Skip to content

chore(deps): update node toolchain (asdf + oracle container + xfuse image) to v24.20.0 - #41

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image)
Open

chore(deps): update node toolchain (asdf + oracle container + xfuse image) to v24.20.0#41
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image)

Conversation

@renovate

@renovate renovate Bot commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
node (source) container minor 24.19.0-alpine → 24.20.0-alpine
node (source) final minor 24.19.0-bookworm-slim → 24.20.0-bookworm-slim
node (source) minor 24.19.0 → 24.20.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

nodejs/node (node)

v24.20.0: 2026-08-26, Version 24.20.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes
Commits

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image) branch from b2072bf to 5fb4f44 Compare August 27, 2026 10:08
schmonz pushed a commit that referenced this pull request Aug 27, 2026
schmonz @claude
release: 0.20260827.1 — cut under the day it ships
69db48b 
Four-file bump (VERSION, package.json, package-lock.json x2) to match the
changelog the user re-dated. The cut was staged on the 25th and took two more
days: absorbing 2.1.246 and 2.1.247, merging thirteen Renovate bumps, and getting
haiku back to shipping. Date versioning names the day it ships, not the day it
was drafted.

The changelog is the user's, in their voice. Two things were removed from my
draft during review and both were right. The naude "Known issue" became false
when the graph runner landed. And the CA-store line claimed we now "verify
certificates using the real bundled CA store", which reads as though verification
had been broken — it never was: mbedtls and libwebsockets always verified against
the engine's vendored Mozilla bundle, and what was empty was only the JS-visible
tls.rootCertificates array. Shipping that sentence would have been a false
security claim.

Gate state at the bump: 38/38 green on 490a9d1, Renovate queue clear apart from
#41 (node 24.20.0), which cannot merge until Docker Hub publishes a matching
-alpine image and will self-clear when it does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMm6zrQy4L7zQYRD1esZko
@renovate
renovate Bot force-pushed the renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image) branch 2 times, most recently from e0861a0 to 2f1bcf8 Compare August 27, 2026 21:11
@renovate renovate Bot changed the title chore(deps): update node.js to v24.20.0 chore(deps): update node toolchain (asdf + oracle container + xfuse image) to v24.20.0 Aug 27, 2026
schmonz pushed a commit that referenced this pull request Aug 28, 2026
schmonz @claude
fix(shim): absorb node 24.20.0 — add RSA_SSLV23_PADDING, and do NOT c…
2cb4003 
…hase its IDNA change

Renovate #41 (node 24.19.0 -> 24.20.0) went 33/38. Two of the failures are real
upstream movement and are handled here; they are opposite kinds, which is the
point of writing them up rather than just making CI green.

ABSORB. node 24.20.0 exposes crypto.constants.RSA_SSLV23_PADDING, which our shim
lacked, so the constants gap inventory grew a row. It is the legacy OpenSSL value
2 — note the table jumped RSA_PKCS1_PADDING:1 straight to RSA_NO_PADDING:3, so 2
was exactly the hole. Added. The gap report only flags keys host node HAS and the
shim lacks, so a shim superset is stable in both directions and the golden needs no
edit. Hand-editing this literal is fine where it would not be for errno/O_*: SSL
constants are fixed numbers, not platform-dependent tables.

DO NOT CHASE. node 24.20.0 returns 'xn--' from url.domainToASCII('xn--'). An
invalid A-label must yield '' per the WHATWG URL algorithm and per node's own
documentation. Measured: 24.19.0 gives '' (this test was green against it),
26.3.0 gives '' (checked directly on this box), 24.20.0 alone gives 'xn--'. Our
wurl is exact against the 1,317-case WPT golden and returns ''. Matching 24.20.0
would mean breaking WPT conformance to copy one patch release that both its
predecessor and its successor contradict.

So that case moves out of the differential comparison into an assertion against
the SPEC, with the three measurements recorded beside it. Coverage is kept, not
dropped — and if a later node settles on 'xn--', that assertion is where we find
out, which a deleted test could never do.

Matching upstream is the default; it is not the same as matching upstream's bugs,
and the difference has to be argued from evidence rather than convenience.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMm6zrQy4L7zQYRD1esZko
@schmonz

schmonz commented Aug 28, 2026

Copy link
Copy Markdown
Owner

@renovate rebase

@schmonz
schmonz force-pushed the renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image) branch from 2f1bcf8 to ed01fbc Compare August 28, 2026 00:33
@renovate
renovate Bot force-pushed the renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image) branch 5 times, most recently from a6ddcdf to 12f949d Compare August 30, 2026 11:30
schmonz pushed a commit that referenced this pull request Aug 30, 2026
schmonz @claude
fix(ci): the runner context does not exist in job-level env
4c8d94c 
009c473 put TMP/TEMP/TMPDIR: ${{ runner.temp }} in the suite job's `env:`.
The `runner` context is only available inside steps, so the workflow became
invalid and failed to START: zero jobs, no workflow name, no annotation,
and no diagnostic anywhere in the API. Main ran no CI at all, and PR #41
inherited it — a pull_request run builds from the merge with main, so a
broken workflow on main takes the PR's checks down with it.

Same redirect, done in a step, where RUNNER_TEMP is a real environment
variable. The comment now says why it cannot go back to job level.

Worth noting how it presented, because it fooled me twice: `gh run list`
reports workflowName as a path for every run here, so that is not the
tell. The tell is jobs=0 with conclusion=failure — a1a42bf7e and 58bdf87
both show 38 jobs, 009c473 shows none.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMm6zrQy4L7zQYRD1esZko
@renovate
renovate Bot force-pushed the renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image) branch 2 times, most recently from 9ac5b23 to b069066 Compare August 30, 2026 11:48
@renovate
renovate Bot force-pushed the renovate/node-toolchain-(asdf-+-oracle-container-+-xfuse-image) branch from b069066 to 37ad46c Compare August 30, 2026 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@schmonz