Visitar URL original
chore: bump node to v24.22.0 (43-x-y) by electron-roller[bot] · Pull Request #55003 · electron/electron · GitHub
Skip to content

chore: bump node to v24.22.0 (43-x-y) - #55003

Merged
MarshallOfSound merged 17 commits into
43-x-yfrom
roller/node/43-x-y
Oct 15, 2026
Merged

MarshallOfSound merged 17 commits into
43-x-yfrom
roller/node/43-x-y

Conversation

@electron-roller

Copy link
Copy Markdown
Contributor

Updating Node.js to v24.22.0.

See all changes in v24.21.0..v24.22.0

Notes: Updated Node.js to v24.22.0.

@electron-roller electron-roller Bot added backport-check-skip Skip trop's backport validity checking semver/minor backwards-compatible functionality labels Oct 15, 2026
@electron-roller
electron-roller Bot requested a review from a team as a code owner October 15, 2026 13:00
Upstream now enables the V8 sandbox only for shared-cage builds. Keep
Electron's behaviour of enabling it whenever pointer compression is on,
matching Chromium's V8. The unofficial.gni x86 hunk landed upstream.

Ref: nodejs/node#62237
Ref: nodejs/node#65491
Upstream dropped the BoringSSL guard in DhKeyGenTraits::Setup(), removed
ReadASN1Element() from ncrypto, and no longer includes <openssl/evp.h>
from env.h, so those hunks are no longer needed.

Ref: nodejs/node#65966
Ref: nodejs/node#66108
Ref: nodejs/node#65484
Upstream's CppgcWrapperList::Cleanup() now pops nodes itself and the
wrapper owns and frees its list node, so the local PopFront/delete hunk
is dropped.

Ref: nodejs/node#65778
ncrypto's DigestCache::aliases() now has a function-local static, so
ncrypto needs the no_exit_time_destructors config too.

Ref: nodejs/node#65484
@MarshallOfSound
MarshallOfSound requested a review from a team as a code owner October 15, 2026 17:52
… snapshot

SnapshotData::AsEmbedderWrapper() was removed. Both call sites wrap the
embedded snapshot, so use EmbedderSnapshotData::BuiltinSnapshotData().

Ref: nodejs/node#65820
node::CreateEnvironment() no longer installs the per-isolate message
listener when it builds the environment from a snapshot, so stop
compensating for that and let SetIsolateUpForNode() add it.

Ref: nodejs/node#65407
…e test

Chromium's V8 removed --experimental-wasm-rab-integration after shipping
it; the new test-internal-webidl-buffer-source.js passes it.

Ref: nodejs/node#65845
Ref: https://chromium-review.googlesource.com/c/v8/v8/+/7708297
Upstream moved the SecureContext external-memory Increase() into Init()
and guards the Decrease() on ctx_, so the leak this patch fixed is gone.
The patch's removal of that guard now double-decrements when v24.22.0's
TLSSocket closes a single-use context before the wrapper is destroyed,
tripping V8's ExternalMemoryAccounter DCHECK in every TLS test. Already
dropped on main in #53524.
…as root

test-fs-rmSync-special-char-additional-error.js is new in v24.22.0 and
relies on a read-only directory blocking removal, which root bypasses;
the Linux Node.js test job runs as root.

Ref: nodejs/node#64453
@MarshallOfSound
MarshallOfSound enabled auto-merge (squash) October 15, 2026 21:39
@MarshallOfSound
MarshallOfSound merged commit 6bb4a9f into 43-x-y Oct 15, 2026
76 checks passed
@MarshallOfSound
MarshallOfSound deleted the roller/node/43-x-y branch October 15, 2026 23:09
@release-clerk

release-clerk Bot commented Oct 15, 2026

Copy link
Copy Markdown

Release Notes Persisted

Updated Node.js to v24.22.0.

shariqh added a commit to shariqh/agent-inbox that referenced this pull request Oct 24, 2026
Electron 43.8.1 contains the fix for GHSA-jr5w-w6x2-84p9, the
mitigation for compromised eMudhra intermediate certificates. It also
makes link-opened windows use the opener's session and webPreferences
(electron/electron#55049), and setCertificateVerifyProc is no longer
skipped for a request issued concurrently with the first request to a
host (electron/electron#55047). 43.8.3, the newest 43.x release, adds
electron/electron#55147: 64 upstream cherry-picks from ANGLE,
Chromium, PDFium, Skia and V8, including use-after-free fixes and
"[net] Validate server certificate before generating auth token". It
embeds the same Node.js 24.22.0, so the modules ABI stays 148.

Update every pin together so the release-input gates agree, as #191
did:
- the package.json devDependency and allowScripts entry, and
  package-lock.json (npm install --save-exact electron@43.8.3);
- electron.version in release/linux-inputs.json,
  release/macos-inputs.json and release/windows-inputs.json, and
  PINNED_ELECTRON_VERSION in scripts/windows-release-inputs.mjs;
- the linux-inputs.json SHA-256 pinned by the AppImage (x64, arm64)
  and DEB contracts, and their tests;
- the tests that compare with the real pins, and the release docs.
Test placeholders that never compare with the real pin, and
historical records, keep 43.8.0.

How Electron's downloads are checked: the release build does not use
the npm package's checksums.json. The three thin-app builders call
packager() without a download or electronZipDir option, so
@electron/get checks each zip only against the release's live
SHASUMS256.txt. At bump time all 75 checksums.json entries matched
the official v43.8.3 SHASUMS256.txt, and the five packaged zips also
match GitHub's asset digests. Pinning the build to checksums.json is
tracked in #363.

The #135 fix now comes from Node.js itself: Electron dropped its
electron/electron#53393 backport when 43.8.0 moved to Node.js 24.22.0
(electron/electron#55003), because 24.22.0 carries the cleanup-hook
registry fix. 43.7.11 is the last release with the patches.
docs/macos-release.md and the electron-sqlite-check abort message now
say so. nodejs/node#65446 is still open, and the portable runtime
keeps its 24.18.1 hold (#362).

Every packaging job's allocation-driven SQLite check passed under
Electron 43.8.3 with Node v24.22.0 (ABI 148): the Linux folders,
AppImage and DEB on x64 and arm64, both macOS thin apps (native Intel
included), and the Windows native folder and MSI folders. The
Electron executable still needs glibc 2.25 on Linux x64 and arm64.

Supersedes #355.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-check-skip Skip trop's backport validity checking semver/minor backwards-compatible functionality

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants