[renovate]

This PR contains the following updates:

Package	Type	Update	Change
node	uses-with	minor	26.12.1 → 26.13.0

---

Release Notes

actions/node-versions (node)

v26.13.0: 26.13.0

Compare Source

Node.js 26.13.0

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 005f727

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge as-is. This update moves Node.js 26 into Long Term Support with no functional changes beyond metadata.

📦 Update Summary

• Library: Node.js
• Version: 26.12.1 → 26.13.0
• Change Type: Minor

📝 Release Notes

Release Date: October 28, 2026

Official Release Notes:

• Node.js 26.13.0 Release

Key Changes:

• Node.js 26.x enters Long Term Support (LTS) under the codename 'Lithium'
• LTS support will continue until the end of April 2029
• No functional changes from 26.12.1 — only metadata updates to mark the release as LTS (such as the process.release object)

Important Note for Users Upgrading from Earlier LTS:

• Since Node.js 25, official Linux binaries are linked against libatomic
• Users upgrading from Node.js 22 or 24 LTS may need to install libatomic separately depending on their Linux distribution

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None in 26.13.0. The previous version (26.12.1, released October 21, 2026) was the security release that fixed 10 CVEs including 4 High-severity issues. Node.js 26.13.0 inherits all these security fixes since it's based on 26.12.1.
• Supply-chain notes: This is an official Node.js release with no red flags. The update is from the trusted actions/node-versions repository maintained by GitHub Actions team.

Security Fixes Inherited from 26.12.1:

The October 2026 security release (26.12.1) fixed the following vulnerabilities:

High Severity:

• CVE-2026-111497: Brotli decoder out-of-bounds write leading to potential RCE
• CVE-2026-105482: DNS resolution hostname truncation at NUL byte
• CVE-2026-105483: TLS hostname bypass with fullwidth digits
• CVE-2026-106069: IP validation mismatch with octal notation

Medium Severity:

• CVE-2026-105481: HTTP keep-alive response timing issue
• CVE-2026-106072: Non-canonical IPv4 DNS SAN matching
• CVE-2026-106074: Entropy cache persistence in snapshots

Low Severity:

• CVE-2026-106070: ZIP header validation bypass
• CVE-2026-106071: Wildcard permission over-granting
• CVE-2026-106073: Insufficient permission checks in fs.realpathSync()

Source: Node.js October 2026 Security Releases

🚨 Breaking Changes

None. This is purely a metadata update to designate the release as LTS.

✨ Main Changes

LTS Designation:

• Node.js 26.x is now officially a Long Term Support release
• Codename: Lithium
• Support timeline: Through April 2029

Metadata Updates:

• The process.release object now reflects LTS status
• No code changes, bug fixes, or feature additions beyond the LTS designation

🔍 Impact Analysis

📁 Usage Locations

Node.js version 26.13.0 is used in 1 file:

1. .github/workflows/lockfile-audit-fix.yml

   - name: Install Node.js
     uses: actions/setup-node@​949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
     with:
       node-version: "26.13.0"

   • Feature used: GitHub Actions workflow for automated lockfile security auditing
   • Impact: None. The workflow runs daily to audit and fix pnpm-lock.yaml vulnerabilities. The Node.js version update is backward-compatible with no behavior changes.

Additional Context:

Other workflows in this repository use a matrix strategy to test against multiple Node.js versions:

• .github/workflows/test.yml: Tests on Node.js 22 and 24 (matrix)
• .github/workflows/pkg-pr-new.yml: Tests on Node.js 22 and 24 (matrix)

The lockfile-audit-fix workflow is the only workflow with a hardcoded Node.js version, and it has been updated to the latest LTS release.

Verification Checklist:

• Executed all search patterns in Phase 1
• Checked library-specific patterns in Phase 2
• Searched for main APIs in Phase 3 (not applicable - infrastructure dependency)
• Confirmed all found files with Read
• Included all usage locations in the report
• Verified dependencies in workflow files

---