Keeping npm up to date in Node.js

[reggi]

Keeping npm up to date in Node.js

Hi Node.js team! I (@reggi) opened npm update PRs for the supported Node.js branches.

The Node.js branches are currently out of sync:

Node.js	Status	Bundled npm	Latest release in that npm major
26	Current	11.17.0	11.19.0
25	EOL	11.12.1	11.19.0
24	Active LTS	11.16.0	11.19.0
23	EOL	10.9.2	10.9.9
22	Maintenance LTS	10.9.8	10.9.9
21	EOL	10.5.0	10.9.9
20	EOL	10.8.2	10.9.9
19	EOL	9.6.3	9.9.4
18	EOL	10.8.2	10.9.9

We opened these PRs to update the supported branches:

• npm 12.0.2 → Node.js main: deps: upgrade npm to 12.0.2 nodejs/node#64882
• npm 11.19.0 → Node.js v26.x-staging: deps: upgrade npm to 11.19.0 nodejs/node#64883
• npm 10.9.9 → Node.js v22.x-staging: deps: upgrade npm to 10.9.9 nodejs/node#64884
• npm 11.19.0 → Node.js v24.x-staging: deps: upgrade npm to 11.19.0 nodejs/node#64885

These are the commands I ran:

gh workflow run create-node-pr.yml -R npm/cli -f spec=latest -f branch=main
gh workflow run create-node-pr.yml -R npm/cli -f spec=next-11 -f branch=26
gh workflow run create-node-pr.yml -R npm/cli -f spec=next-11 -f branch=24
gh workflow run create-node-pr.yml -R npm/cli -f spec=next-10 -f branch=22

I did not create PRs against EOL branches.

• Should we update those branches as well?

[MikeMcC399]

Should we update those branches as well?

Node.js EOL branches are frozen and are no longer released. It would be confusing to submit a PR for an EOL branch, and Node.js would probably just reject it.

[aliceshi-aaaaaokkk]

Could you fix the following CVE issues in node 22?
┌────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────┤
│ brace-expansion (package.json) │ CVE-2026-14257 │ HIGH │ fixed │ 5.0.7 │ 5.0.8, 3.0.3, 2.1.3, 1.1.17 │ brace-expansion through 5.0.7 is vulnerable to denial of │
│ │ │ │ │ │ │ service via m ...... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2026-14257 │
├────────────────────────────────┼─────────────────────┼──────────┤ ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────┤
│ tar (package.json) │ GHSA-r292-9mhp-454m │ MEDIUM │ │ 7.5.19 │ 7.5.21 │ node-tar: Uncontrolled recursion in mapHas/filesFilter │
│ │ │ │ │ │ │ allows uncatchable stack-overflow DoS via crafted │
│ │ │ │ │ │ │ long-path... │
│ │ │ │ │ │ │ GHSA-r292-9mhp-454m │
└────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────┘