Repository navigation
Conversation
Replace the 24.22.0 release-proposal snapshot with the official v24.22.1 tag (ce7aaf1) and bump the mobile version to 24.22.1-0. The reviewed proposal commit differs from the published v24.22.0 tag only in doc/changelogs/CHANGELOG_V24.md, so the pin swap carries no unreviewed source change. The rebase re-emitted 20 patches; only two changed, and only in context/line numbers: common.gypi (v8_embedder_string) and the mobile adjustment in src/crypto/crypto_context.cc, whose upstream X.509 hardening lands ahead of the mobile hunks. The mobile hunks themselves are unchanged. This is upstream's security release for the line: seven CVEs covering tls IP normalization and non-canonical IP addresses, dns resolve null bytes, the http agent data guard, the permission model in realpathSync, crypto snapshot random caches and brotli block-switch decoding, plus OpenSSL 3.5.9, c-ares 1.34.9, undici 7.30.1, tzdata 2026e, root certificates NSS 3.131.1 and the rejection of certificate chains with blocked public keys. test-crypto-random-cache-snapshot is excluded on Android and iOS: it builds and runs snapshots through common/snapshot, which spawns child Node executables. The remaining new in-process regressions stay runnable and the full device suite confirms them. A clean reconstruction reproduces tree 1d7a16b3d618c697f4da5a6762d065f33688a3cc (expected-tree.txt). Local recipe tests pass, including 3776 runnable Android suite cases across 16 shards. Android/iOS compilation and device validation remain for CI. release-ready.txt and release-upstream-snapshot.txt are left empty: the line is backed by an official tag now, and arming a version is the reviewed Cut release step. Assisted-by: Codex Signed-off-by: fogtape <lilixu3210@gmail.com>
The full Android suite fails parallel/test-crypto-x509: upstream 24.22.1 runs the malformed-certificate legacy conversion in a child so a native regression is reported as a signal, and an app cannot spawn a child Node. Android's process.execPath is app_process, which aborts with "Error changing dalvik-cache ownership : Permission denied" (SIGABRT), and the iOS app has no executable to spawn either. Run the same conversion and assertions in-process on both platforms instead. A native abort still fails the run through the harness crash verdict, so the regression is still caught. A clean reconstruction reproduces tree 59a1f9b50b39080936dc0e78838b3945da83d8e0 (expected-tree.txt). Assisted-by: Codex Signed-off-by: fogtape <lilixu3210@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Moves the Node 24 line off the
24.22.0release-proposal snapshot and ontothe official
v24.22.1LTS security release(
ce7aaf1cee78b8cf0ce17364260535c418d3ed26), bumping the mobile version to24.22.1-0.docs/UPGRADING.mdrequires exactly this step once the official tag exists:compare the proposal with the published tag, update the pin, regenerate and
rerun the gates. The comparison is clean — the reviewed proposal commit
(
a5d0eb95) differs from the publishedv24.22.0tag only indoc/changelogs/CHANGELOG_V24.md— so no unreviewed source change ridesalong.
Why it matters
v24.22.1is upstream's security release for this line: seven CVEs coveringtls IP normalization and non-canonical IP addresses, dns resolve null bytes,
the http agent data guard, the permission model in
realpathSync, cryptosnapshot random caches and brotli block-switch decoding. It also carries
OpenSSL 3.5.9, c-ares 1.34.9, undici 7.30.1, tzdata 2026e, root certificates
NSS 3.131.1 and the rejection of certificate chains with blocked public keys.
These are the surfaces the lite runtime keeps (HTTP/TLS/crypto/fetch/dns/zlib),
and this line builds OpenSSL from source, so it takes the 3.5.9 update
directly.
Rebase
All 20 patches apply. Only two change, and only in context/line numbers:
common.gypi(v8_embedder_string) and the mobile adjustment insrc/crypto/crypto_context.cc, whose upstream X.509 hardening lands ahead ofthe mobile hunks. The mobile hunks themselves are unchanged.
test-crypto-random-cache-snapshotis excluded on Android and iOS: it buildsand runs snapshots through
common/snapshot, which spawns child Nodeexecutables — the same limitation as the existing snapshot exclusions. The
other new regressions (tls non-canonical IP and SPKI blocklist, dns null
bytes, http agent pending read, X.509 name conversion) stay runnable and the
full device suite confirms them.
Verification
nodejs/node@v24.22.1reproduces tree
1d7a16b3d618c697f4da5a6762d065f33688a3cc, matchingexpected-tree.txt.device compatibility (1), emulator preparation (7), Android proxy (10), iOS
smoke (4), release control, and the Android suite coverage check — 3776
runnable cases across 16 shards with no gaps or duplicates.
list lint (239 entries), zero workflow files in the product tree, and the
test-edit audit all pass.
release-ready.txtandrelease-upstream-snapshot.txtare left empty: theline is backed by an official tag now, and arming a version is the reviewed
Cut release step. Android/iOS compilation and the device gates remain for
CI.