Repository navigation
Update all dependencies - #1088
Merged
Merged
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
renovate
Bot
force-pushed
the
deps/all
branch
from
October 21, 2026 21:53
1e86883 to
1a2c4f3
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1088 +/- ##
=======================================
Coverage 99.22% 99.22%
=======================================
Files 180 180
Lines 9570 9570
=======================================
Hits 9496 9496
Misses 74 74 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~11.4.10→~11.4.11~11.4.10→~11.4.11~11.4.10→~11.4.11~11.4.10→~11.4.11>=24.22.0→>=24.22.126.9.0→26.10.026.9.0→26.10.026.9.0→26.10.026.9.0→26.10.0Release Notes
drupal/core-composer-scaffold
v11.4.11Compare Source
drupal/core-dev
v11.4.11Compare Source
drupal/core-project-message
v11.4.11Compare Source
drupal/core-recommended
v11.4.11Compare Source
nodejs/node (node)
v24.22.1: 2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel)0ed4268(Evgenii Kliuchnikov)Commits
2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #668774d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#9874b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#10079243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #664961e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #6686849dff6f57a] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#1002fca511adc5] - deps: V8: backport93cd21e(Joyee Cheung) nodejs-private/node-private#100818711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #663961d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#98496c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#9838dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973b5f41529df] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#100201acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#9859dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855uselagoon/lagoon-images (uselagoon/mariadb-10.11-drupal)
v26.10.0: lagoon-images 26.10.0Compare Source
Notes on this release
This is a security-driven release. It updates PHP to 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical (CVSS 9.2) remote code execution vulnerabilities in PHP core: GHSA-w8hw-w9fx-j79w (CVE-2026-109618, RCE via OOM corruption) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, RCE via stale global state). Both can be exploited without authentication, and PHP states that updating is the only complete mitigation, so all PHP-based images should be rebuilt and redeployed as soon as possible. The release also updates the Node.js (v24 and v26), Python (3.10–3.14) and Ruby 3.4 base images, Solr and OpenSearch, the PHP tooling (PIE and php-extension-installer), and some GitHub Actions dependencies.
New/Deprecated/Removed Images
No images were introduced/deprecated/removed in this release.
Changes in this release
Package Updates
PHP related
Foundations
Databases / Caches / Search
Web / Runtime bases
Devops
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.