2026-09-01, Version 22.23.3 'Jod' (LTS) - #65443

the binary-upload target uses $(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz as the
name to upload whereas it is created by the $(BINARYTAR) target as
$(BINARYNAME). Since BINARYNAME includes the optional VARIATION when
present this gets missed out int he binary-upload target, for example
during a release build for Alpine/musl. This commit changes the
binary-upload target to use the same variable for the tarball that is
used when the file is created.

Signed-off-by: Stewart X Addison <[email protected]>
PR-URL: #65282
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #62324
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Creates a SharedArrayBuffer from externally managed memory.

Fixes: #62259
PR-URL: #62623
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Vladimir Morozov <[email protected]>
Reviewed-By: Robert Nagy <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #62961
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #62962
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #62810
Reviewed-By: Antoine du Hamel <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63110
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: umuoy1 <[email protected]>
PR-URL: #62710
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Vladimir Morozov <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #63375
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

This is the [`certdata.txt`][0] from NSS 3.123.1.

This is the version of NSS that shipped in Firefox 151.0.1 on 2026-05-21

Certificates removed:
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- Izenpe.com
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB

[0]: https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_123_1_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #63527
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63515
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Edy Silva <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #63938
Refs: nodejs/node-core-utils#1094
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Daijiro Wachi <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Original commit message:

    Fixes #1056

    The commit
    c-ares/c-ares@1d1b3d4
    refactored the function to use wide strings, but didn't touch this
    check. Because an empty wide string would now be size 2 and not 1, the
    empty string would go on and cause the DNS domain list to be replaced
    with nothing.

    Signed-off-by: @dankmeme01

Refs: c-ares/c-ares@8ba37af
PR-URL: #64110
Fixes: #62347
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #64070
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #64259
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #64330
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: #64166
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

PR-URL: #64588
Reviewed-By: René <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

This is the certdata.txt[0] from NSS 3.125.

This is the version of NSS that shipped in Firefox 153.0 on 2026-07-21.

Certificates removed:
- Entrust Root Certification Authority
- SecureSign Root CA12

[0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_125_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #64746
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.

Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <[email protected]>
PR-URL: #64753
Fixes: #64752
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: René <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64651
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Hiroki Osame <[email protected]>
PR-URL: #65108
Fixes: #65104
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #65217
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Tierney Cyren <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Notable changes:

crypto:
  * update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527

PR-URL: #65443