chore(deps): update all non-major dependency bump

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
node (source)		patch	24.18.0 → 24.18.1
semantic-release	devDependencies	patch	25.0.5 → 25.0.8

---

Release Notes

nodejs/node (node)

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #​64713
• [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #​63752
• [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • "before 5am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.