From cef277aa804da0ad8c091a4b230ba02f8135b35b Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Fri, 23 Oct 2026 15:56:39 +0000 Subject: [PATCH] chore: upgrade Node to 26.12.1 (CVE-2026-111497) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Node 25.x is end of life and gets no fix for CVE-2026-111497 (Node2Shell). Pin the mise toolchain to 26.12.1 and relock its per-platform checksums (verified against the nodejs.org SHASUMS256). _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_ Change-Id: I8ed8cd06557dada394962a9d5cdb28dfce50ebca Signed-off-by: Thomas Kosiewski --- mise.lock | 30 +++++++++++++++--------------- mise.toml | 2 +- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/mise.lock b/mise.lock index 403d20e..97efd01 100644 --- a/mise.lock +++ b/mise.lock @@ -35,36 +35,36 @@ url = "https://github.com/jdx/communique/releases/download/v1.0.3/communique-x86 url_api = "https://api.github.com/repos/jdx/communique/releases/assets/403765157" [[tools.node]] -version = "25.9.0" +version = "26.12.1" backend = "core:node" [tools.node."platforms.linux-arm64"] -checksum = "sha256:8fb4283301b8c720fc9f18bffff0f659e72cc14d0cf207a3bb411808aaa73a57" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-linux-arm64.tar.gz" +checksum = "sha256:a6c01af459dd8972ab3fb08ee5da81244d26ba8c4944a62d5bbba8c597ae154f" +url = "https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-arm64.tar.gz" [tools.node."platforms.linux-arm64-musl"] -checksum = "sha256:8fb4283301b8c720fc9f18bffff0f659e72cc14d0cf207a3bb411808aaa73a57" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-linux-arm64.tar.gz" +checksum = "sha256:c3694551f6cb888fe0befb4cb2e13ffe45b0bb2528ec141e7c3a29a7d7974d13" +url = "https://unofficial-builds.nodejs.org/download/release/v26.12.1/node-v26.12.1-linux-arm64-musl.tar.gz" [tools.node."platforms.linux-x64"] -checksum = "sha256:134e55b2408448a219760fe04dc44d6851f9de8a79549021ffd870e9082d9e7b" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-linux-x64.tar.gz" +checksum = "sha256:0fd1eb7770598f52a21995edf6ed35fc690400fa437c2386af329519e9143132" +url = "https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.gz" [tools.node."platforms.linux-x64-musl"] -checksum = "sha256:134e55b2408448a219760fe04dc44d6851f9de8a79549021ffd870e9082d9e7b" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-linux-x64.tar.gz" +checksum = "sha256:8bf9cc0e7f8e3c7ec5368dca19242cad651b6b09d35bcdcf290ac3f80925e8dd" +url = "https://unofficial-builds.nodejs.org/download/release/v26.12.1/node-v26.12.1-linux-x64-musl.tar.gz" [tools.node."platforms.macos-arm64"] -checksum = "sha256:e479f3c469d3d9303a44f00a8ea37a3788395d171bb8059c48a4bbbd2e371b59" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-darwin-arm64.tar.gz" +checksum = "sha256:1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8" +url = "https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz" [tools.node."platforms.macos-x64"] -checksum = "sha256:7d737b53ce191142bfa1c17cfa5b070d96e84eebf76b8dd06d84981cbdc3f7e3" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-darwin-x64.tar.gz" +checksum = "sha256:b85c2ea4420ad0bc4abf2dc6cf1f55130ed681f1cabf60cf3f526e4c9e2712ff" +url = "https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-x64.tar.gz" [tools.node."platforms.windows-x64"] -checksum = "sha256:929552b8305effac843ba7b4270c437aefb702fc3fbd73fcd1bffd35d4ac284e" -url = "https://nodejs.org/dist/v25.9.0/node-v25.9.0-win-x64.zip" +checksum = "sha256:b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4" +url = "https://nodejs.org/dist/v26.12.1/node-v26.12.1-win-x64.zip" [[tools.zig]] version = "0.15.2" diff --git a/mise.toml b/mise.toml index abe42db..ddfd277 100644 --- a/mise.toml +++ b/mise.toml @@ -1,6 +1,6 @@ [tools] communique = "1.0.3" -node = "25.9" +node = "26.12.1" zig = "0.15.2" [tasks.ci]