chore(deps): update node.js to v24.14.1

This MR contains the following updates:

Package	Type	Update	Change
node	image	minor	24.13.1-alpine → 24.14.1-alpine

---

Release Notes

nodejs/node (node)

v24.14.1: 2026-03-24, Version 24.14.1 'Krypton' (LTS), @​RafaelGSS prepared by @​juanarbol

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
• (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
• (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low

Commits

• [6fae244080] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#828
• [cc0910c62e] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#822
• [80cb042cf3] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #​62271
• [f5b8667dc2] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #​62233
• [08852637d9] - deps: update undici to 7.22.0 (Node.js GitHub Bot) #​62035
• [61097db9fb] - deps: upgrade npm to 11.11.0 (npm team) #​61994
• [9ac0f9f81e] - deps: upgrade npm to 11.10.1 (npm team) #​61892
• [3dab3c4698] - deps: V8: override depot_tools version (Richard Lau) #​62344
• [87521e99d1] - deps: V8: backport 1361b2a (Joyee Cheung) nodejs-private/node-private#828
• [045013366f] - deps: V8: backport 185f0fe (Joyee Cheung) nodejs-private/node-private#828
• [af22629ea8] - deps: V8: backport 0a8b1cd (snek) nodejs-private/node-private#828
• [380ea72eef] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
• [d6b6051e08] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795
• [bfdecef9da] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794
• [c015edf313] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
• [cba66c48a5] - (CVE-2026-21712) src: handle url crash on different url formats (RafaelGSS) nodejs-private/node-private#816
• [df8fbfb93d] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819

v24.14.0: 2026-02-24, Version 24.14.0 'Krypton' (LTS), @​ruyadorno prepared by @​aduh95

Compare Source

Notable Changes

• [8b6d31d379] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #​61415
• [68da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #​61456
• [f3a24c76e4] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #​61167
• [1948861d23] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #​60214
• [d6f7c8d06f] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #​61433
• [cb54b3ca6e] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #​60953
• [35b1759d06] - (SEMVER-MINOR) module: allow subpath imports that start with #/ (Jan Martin) #​60864
• [2d72ea66f2] - (SEMVER-MINOR) process: preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) #​60913
• [6f4a4f6c8e] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #​61167
• [c0ceb9b065] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #​61266
• [33d8e8303b] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #​61311
• [563ab699eb] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #​61548
• [4c80031000] - (SEMVER-MINOR) stream: add bytes() method to node:stream/consumers (wantaek) #​60426
• [f5233df4ff] - (SEMVER-MINOR) stream: do not pass readable.compose() output via Readable.from() (René) #​60907
• [345a40fda3] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #​61167
• [972f82411d] - (SEMVER-MINOR) test_runner: add env option to run function (Ethan Arrowood) #​61367
• [d77f98c4b6] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #​60669
• [8e900af6ba] - (SEMVER-MINOR) util: add convertProcessSignalToExitCode utility (Erick Wendel) #​60963

Commits

• [180778fb9a] - assert: fix loose deepEqual arrays with undefined and null failing (Ruben Bridgewater) #​61587
• [8b6d31d379] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #​61415
• [83bcd38d35] - benchmark: add streaming TextDecoder benchmark (Сковорода Никита Андреевич) #​61549
• [4c105844c5] - build: add support for Visual Studio 2026 (Michaël Zasso) #​60727
• [1f84fd91d9] - build: skip sscache action on non-main branches (Joyee Cheung) #​61790
• [30601b680f] - build: add --shared-nbytes configure flag (Antoine du Hamel) #​61341
• [c6253eda49] - build: add --shared-hdr-histogram configure flag (Antoine du Hamel) #​61280
• [584c189037] - build: add --shared-gtest configure flag (Antoine du Hamel) #​61279
• [5998987881] - build: aix: deoptimize implementation-visitor.cc with --shared (Stewart X Addison) #​61550
• [68da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #​61456
• [6a4511bafb] - build,win: fix vs2022 compilation (Stefan Stojanovic) #​61530
• [2d6735db8a] - deps: upgrade npm to 11.9.0 (npm team) #​61685
• [699e2f8f81] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #​61730
• [7be76316d6] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #​61732
• [97e5a65013] - deps: update undici to 7.21.0 (Node.js GitHub Bot) #​61683
• [74e4710ee7] - deps: update googletest to 56efe39 (Node.js GitHub Bot) #​61605
• [b5113e2a2a] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #​61603
• [f3a24c76e4] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #​61167
• [c370c3dc06] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #​61167
• [e54975e17d] - deps: V8: cherry-pick highway@dcc0ca1 (Richard Lau) #​61008
• [625b90b76b] - deps: update undici to 7.19.2 (Node.js GitHub Bot) #​61566
• [05e9a9fb5e] - deps: update undici to 7.19.1 (Node.js GitHub Bot) #​61514
• [3d41643e38] - deps: update undici to 7.19.0 (Node.js GitHub Bot) #​61470
• [17b363a66c] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #​61453
• [33d0a8c22d] - doc: clarify EventEmitter error handling in threat model (Matteo Collina) #​61701
• [5b8e72cf85] - doc: mention default option for test runner env (Steven) #​61659
• [f44e67fac2] - doc: fix --inspect security warning section (Tim Perry) #​61675
• [a0e09c9043] - doc: document url.format(urlString) as deprecated under DEP0169 (René) #​61644
• [5e719248fe] - doc: deprecation add more codemod (Augustin Mauroy) #​61642
• [8f5a3e5df4] - doc: fix grammatical error in README.md (ayj8201) #​61653
• [d52b535163] - doc: correct tools README Boxstarter link (Mike McCready) #​61638
• [4889dc4f59] - doc: update server.dropMaxConnection link (YuSheng Chen) #​61584
• [8e48e72f2a] - doc: clean up writing-and-running-benchmarks.md (Hardanish Singh) #​61345
• [1948861d23] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #​60214
• [d6f7c8d06f] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #​61433
• [2d7e5f9581] - http: implement slab allocation for HTTP header parsing (Mert Can Altin) #​61375
• [cb54b3ca6e] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #​60953
• [6df8be48ce] - lib: use utf8 fast path for streaming TextDecoder (Сковорода Никита Андреевич) #​61549
• [830fff0aca] - lib: recycle queues (Robert Nagy) #​61461
• [069874bdbd] - lib: use StringPrototypeStartsWith from primordials in locks (Taejin Kim) #​61492
• [7824c7589e] - lib: unify ICU and no-ICU TextDecoder (Сковорода Никита Андреевич) #​61409
• [f81430702a] - lib: prefer call() over apply() if argument list is not array (Livia Medeiros) #​60796
• [a723f72e1e] - lib: add support for readable byte streams to .toWeb() (Hans Klunder) #​58664
• [b78d814b3d] - meta: persist sccache daemon until end of build workflows (René) #​61639
• [40a872a4b9] - meta: bump github/codeql-action from 4.31.9 to 4.32.0 (dependabot[bot]) #​61622
• [0637bdb3be] - meta: bump step-security/harden-runner from 2.14.0 to 2.14.1 (dependabot[bot]) #​61621
• [e8d9bd9fc5] - meta: bump actions/setup-python from 6.1.0 to 6.2.0 (dependabot[bot]) #​61627
• [c517df2b65] - meta: bump actions/setup-node from 6.1.0 to 6.2.0 (dependabot[bot]) #​61625
• [9a64f2f25d] - meta: bump actions/cache from 5.0.1 to 5.0.3 (dependabot[bot]) #​61624
• [0e5922e95e] - meta: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (dependabot[bot]) #​61623
• [5da7b51091] - meta: bump actions/stale from 10.1.0 to 10.1.1 (dependabot[bot]) #​61620
• [c085c8a43f] - meta: bump actions/checkout from 6.0.1 to 6.0.2 (dependabot[bot]) #​61619
• [ce2acf0275] - meta: bump actions/download-artifact from 6.0.0 to 7.0.0 (dependabot[bot]) #​61242
• [629f0eaac5] - meta: bump actions/checkout from 6.0.0 to 6.0.1 (dependabot[bot]) #​61239
• [cd80d369c9] - meta: bump actions/upload-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #​61238
• [8c75e4e1fa] - meta: bump actions/checkout from 5.0.1 to 6.0.0 (dependabot[bot]) #​60925
• [5a9e9f4127] - meta: bump actions/checkout from 5.0.0 to 5.0.1 (dependabot[bot]) #​60767
• [1519251dd1] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #​61529
• [8d7190b3fe] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #​61479
• [35b1759d06] - (SEMVER-MINOR) module: allow subpath imports that start with #/ (Jan Martin) #​60864
• [7a83b38921] - net: defer synchronous destroy calls in internalConnect (RajeshKumar11) #​61658
• [16bab79421] - process: do not truncate long strings in --print (Mohamed Akram) #​61497
• [2d72ea66f2] - (SEMVER-MINOR) process: preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) #​60913
• [9cc1c4604f] - repl: fix getters triggering side effects during completion (Dario Piotrowicz) #​61043
• [93703306a1] - repl: tab completion targets <class> instead of new <class> (Đỗ Trọng Hải) #​60319
• [6f4a4f6c8e] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #​61167
• [46a2dad4db] - sqlite: avoid extra copy for large text binds (Ali Hassan) #​61580
• [f91a377f7e] - sqlite: use DictionaryTemplate for run() result (Mert Can Altin) #​61432
• [0e7571ae3e] - sqlite: change approach to fix segfault SQLTagStore (Bart Louwers) #​60462
• [8e8f70524a] - sqlite: reserve vectors space (Guilherme Araújo) #​61540
• [c0ceb9b065] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #​61266
• [33d8e8303b] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #​61311
• [f0d8f37002] - src: elide heap allocation in structured clone implementation (Anna Henningsen) #​61703
• [db478c4336] - src: use simdutf for one-byte string UTF-8 write in stringBytes (Mert Can Altin) #​61696
• [563ab699eb] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #​61548
• [da13186a15] - src: throw RangeError on failed ArrayBuffer BackingStore allocation (Chengzhong Wu) #​61480
• [4c80031000] - (SEMVER-MINOR) stream: add bytes() method to stream/consumers (wantaek) #​60426
• [f5233df4ff] - (SEMVER-MINOR) stream: do not pass readable.compose() output via Readable.from() (René) #​60907
• [ad04a469c8] - test: restraint version replacement pattern in snapshots (Chengzhong Wu) #​61748
• [2d3b4a8d65] - test: print stack immediately avoiding GC interleaving (Chengzhong Wu) #​61699
• [38f43a6d4e] - test: fix case-insensitive path matching on Windows (Matteo Collina) #​61682
• [06513f5ff2] - test: fix flaky test-performance-eventloopdelay (Matteo Collina) #​61629
• [9d79c66c61] - test: remove duplicate wpt tests (Filip Skokan) #​61617
• [eac9f4f401] - test: fix race condition in watch mode tests (Matteo Collina) #​61615
• [ecf5947575] - test: update WPT for url to e3c46fd (Node.js GitHub Bot) #​61602
• [356ff5fece] - test: use the skipIfNoWatch() utility function (Luigi Pinca) #​61531
• [4b2187aea2] - test: unify assertSnapshot common patterns (Chengzhong Wu) #​61590
• [8c25489d63] - test: split test-fs-watch-ignore-* (Luigi Pinca) #​61494
• [43b8a2b7e7] - test: add some validation for JSON doc output (Antoine du Hamel) #​61413
• [345a40fda3] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #​61167
• [24cf6b8326] - test: reveal wpt evaluation errors in status files (Chengzhong Wu) #​61358
• [d4034dfb62] - test: forbid use of named imports for fixtures (Antoine du Hamel) #​61228
• [4f871ee897] - test: enforce better never-settling-promise detection (Antoine du Hamel) #​60976
• [8e9adedf02] - test: ensure assertions are reached on all tests (Antoine du Hamel) #​60845
• [273832802e] - test: ensure assertions are reached on more tests (Antoine du Hamel) #​60763
• [e06adcb52f] - test: ensure assertions are reached on more tests (Antoine du Hamel) #​60760
• [aeed0ccc02] - test: use RegExp.escape to improve test reliability (Antoine du Hamel) #​60803
• [74bcd0adab] - test: ensure assertions are reached on more tests (Antoine du Hamel) #​60728
• [407807b08e] - test: skip tests not passing without NODE_OPTIONS support (Antoine du Hamel) #​60912
• [a9e70cefb0] - test: ensure assertions are reached on more tests (Antoine du Hamel) #​60634
• [21b23cd0d0] - test_runner: fix test enqueue when test file has syntax error (Edy Silva) #​61573
• [6a4de694b2] - test_runner: fix passing expectFailure (Moshe Atlow) #​61568
• [6640de2b0f] - test_runner: differentiate todo and failure styles (Moshe Atlow) #​61564
• [972f82411d] - (SEMVER-MINOR) test_runner: add env option to run function (Ethan Arrowood) #​61367
• [d77f98c4b6] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #​60669
• [f98986cbb9] - tools: switch to ARM runners on GHA jobs (Antoine du Hamel) #​61903
• [034589dd93] - tools: avoid building twice in coverage jobs (Antoine du Hamel) #​61899
• [e50e2f00bb] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #​61759
• [f658f48ccb] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #​61734
• [65c77d74ff] - tools: use ubuntu-latest runner in notify-on-push workflow (Antoine du Hamel) #​61742
• [605905556a] - tools: enforce removal of lts-watch-* labels on release proposals (Antoine du Hamel) #​61672
• [f0f98d4c03] - tools: use ubuntu-slim runner in meta GitHub Actions (Tierney Cyren) #​61663
• [ab63ddf354] - tools: add LIEF to license builder (Chengzhong Wu) #​61523
• [8a0f6192c9] - tools: enforce trailing commas in test/es-module (Antoine du Hamel) #​60891
• [4afbbcf39e] - tools: enforce trailing commas in test/sequential (Antoine du Hamel) #​60892
• [4c1abf752c] - tools,win: upgrade install additional tools to Visual Studio 2026 (Mike McCready) #​61562
• [8e900af6ba] - (SEMVER-MINOR) util: add convertProcessSignalToExitCode utility (Erick Wendel) #​60963

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Renovate Bot.