nodejs/node v22.22.3

2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolito

on GitHub

Commits

• [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
• [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485
• [e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #62164
• [0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382
• [e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #62256
• [73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
• [ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
• [b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603
• [bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150
• [22ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930
• [f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
• [1a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
• [d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #61879
• [3ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #61834
• [b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
• [ffda97afd4] - deps: update googletest to 2461743991f9aa53e9a3625eafcbacd81a3c74cd (Node.js GitHub Bot) #62484
• [79aa32cf4f] - deps: update googletest to 73a63ea05dc8ca29ec1d2c1d66481dd0de1950f1 (Node.js GitHub Bot) #61927
• [b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
• [3a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
• [d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #62463
• [ec11f3c1d5] - deps: V8: backport 85b390089e51 (Thibaud Michaud) #62783
• [08609712ed] - deps: V8: backport 1b27e4674f11 (Thibaud Michaud) #62783
• [dcc60d5ab2] - deps: V8: backport 9997fc013952 (Thibaud Michaud) #62783
• [1d1f4451fb] - deps: V8: cherry-pick b96e40d5ac85 (Clemens Backes) #62783
• [2268567237] - deps: V8: cherry-pick 7cb6188cf913 (Thibaud Michaud) #62783
• [92804cdbea] - deps: V8: cherry-pick e7ccf0af1bdd (Thibaud Michaud) #62783
• [eae2c27a40] - deps: V8: cherry-pick 8e214ec3ec8c (Thibaud Michaud) #62783
• [a1799a49bb] - deps: V8: backport 63b8849d73ae (Thibaud Michaud) #62783
• [a2df2d8731] - deps: V8: backport 323942700cfe (Thibaud Michaud) #62783
• [e3d65c7dca] - deps: V8: backport 89dc6eab605c (Thibaud Michaud) #62783
• [5e7db133de] - deps: V8: backport 910cb91733dc (Jakob Kummerow) #62783
• [d0c24a28af] - deps: V8: cherry-pick b8f91e510e0f (Thibaud Michaud) #62783
• [d358687824] - deps: V8: cherry-pick cf03d55db2a0 (Thibaud Michaud) #62783
• [67c8b2c349] - deps: V8: cherry-pick 692f3d526a38 (Sébastien Doeraene) #62783
• [71e5a59ffd] - deps: V8: cherry-pick c734674e03f9 (Manos Koukoutos) #62783
• [f0dbe81c7b] - deps: V8: cherry-pick b2f3aea23a01 (Thibaud Michaud) #62783
• [d333f480c3] - deps: V8: cherry-pick 5f1342c20b59 (Matthias Liedtke) #62783
• [db722725bb] - deps: use npm undici@six tag in update-undici.sh (Matteo Collina) #63012
• [9b57979d9c] - doc: add Rafael to last security release steward (Rafael Gonzaga) #62423
• [d8075585bf] - doc: add path to vulnerabilities.json mention (Rafael Gonzaga) #62355
• [6ec9a70204] - doc: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) #62208
• [1fc86fcb6e] - doc: add note (and caveat) for mock.module about customization hooks (Jacob Smith) #62075
• [491be80bd9] - doc: add efekrskl as triager (Efe) #61876
• [18558293a3] - doc: fix module.stripTypeScriptTypes indentation (René) #61992
• [8e20976522] - doc: explicitly mention Slack handle (Rafael Gonzaga) #61986
• [70b8e6b4fb] - doc: rename invalid function parameter (René) #61942
• [4045c76f6c] - doc: clarify status of feature request issues (Antoine du Hamel) #61505
• [c54652f2aa] - doc: remove incorrect mention of module in typescript.md (Rob Palmer) #61839
• [9fad6cedf5] - doc: clarify async caveats for events.once() (René) #61572
• [2f1e5733fe] - doc: update Juan's security steward info (Juan José) #61754
• [a64bdb5068] - doc: fix overstated Date header requirement in response.sendDate (Kit Dallege) #62206
• [02797de923] - doc: fix small environment_variables typo (chris) #62279
• [f22ebdc809] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #62025
• [9f4508062a] - doc: fix methods being documented as properties in process.md (Antoine du Hamel) #61765
• [3ea39ff135] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #61735
• [c22445079b] - doc: fix spacing in process message event (Aviv Keller) #61756
• [32831b5223] - doc: fix broken links of net.md (YuSheng Chen) #61673
• [005508d509] - doc: remove obsolete Boxstarter automated install (Mike McCready) #61785
• [37c2fd6f7d] - esm: fix path normalization in finalizeResolution (Antoine du Hamel) #62080
• [1769d74613] - esm: populate separate cache for require(esm) in imported CJS (Joyee Cheung) #59679
• [ee02966ffc] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #61710
• [2fdb5ce6cc] - http2: fix FileHandle leak in respondWithFile (sangwook) #61707
• [aa2c1eca04] - lib: fix source map url parse in dynamic imports (Chengzhong Wu) #61990
• [785b00cbeb] - meta: pass release version to release worker (flakey5) #62777
• [447fb9a0b5] - meta: persist sccache daemon until end of build workflows (René) #61639
• [5065a0acb3] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #61529
• [9a2e21305d] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #61479
• [b9240bc063] - module: fix sync resolve hooks for require with node: prefixes (Joyee Cheung) #61088
• [2e91b28aaf] - module: handle null source from async loader hooks in sync hooks (Joyee Cheung) #59929
• [39147c154e] - module: use sync cjs when importing cts (Marco Ippolito) #60072
• [12a2462b2c] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874
• [cf39566277] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948
• [578a9a9230] - src: clamp WriteUtf8 capacity to INT_MAX in EncodeInto (semimikoh) #62621
• [57c3035fec] - stream: fix decoded fromList chunk boundary check (Thomas Watson) #61884
• [57fb008bb8] - test: update tls junk data error expectations (Filip Skokan) #62629
• [363f9a9d18] - test: skip test-url on --shared-ada builds (Antoine du Hamel) #62019
• [daaead342b] - test: simplify encodeInto large buffer regression test (semimikoh) #62621
• [ecfa766b41] - tools: fix auto-start-ci (Antoine du Hamel) #61900
• [17c0a610af] - tools: fix parsing of commit trailers in lint-release-proposal GHA (Antoine du Hamel) #62077
• [89ad7dc63b] - tools: enforce removal of lts-watch-* labels on release proposals (Antoine du Hamel) #61672
• [5f9bb8ef0c] - tools: revert tools GHA workflow to ubuntu-latest (Richard Lau) #62024
• [977ef80ac1] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #62574
• [ad8f518a81] - zlib: fix use-after-free when reset() is called during write (Matteo Collina) #62325