[doa-renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/docker (source)		patch	29.9.1-dind → 29.9.2-dind
ghcr.io/renovatebot/renovate (source)		patch	44.175.0 → 44.175.3
node (source)	final	patch	26.12.0-trixie-slim → 26.12.1-trixie-slim

---

Release Notes

renovatebot/renovate (ghcr.io/renovatebot/renovate)

v44.175.3

Compare Source

Bug Fixes

• workers/repository/lookup: warn when a tag is missing its v prefix (#​47155) (b91f928)

Documentation

• mend-hosted: Enterprise users can specify forkProcessing and onboardingNoDeps (#​47246) (bd4ba3b)

Build System

• deps: update dependency node to v24.22.1 (main) (#​47264) (8ca0fec)

v44.175.2

Compare Source

Bug Fixes

• manager/kustomize: handle helm charts without repo (#​47255) (06d7f77)
• manager/npm: omit unresolved npmrc from extracted package files (#​47258) (25d7295)
• workers: keep absent registry URLs absent when detaching credentials (#​47256) (571a269)

v44.175.1

Compare Source

Bug Fixes

• config/validation: remove custom validation for allowedValues (#​43833) (e6cdac8)
• config/validation: validate allowedValues for arrays (#​39076) (e5ae141)
• config/validation: validate customDatasources generically (#​47195) (b4de4ca)
• config/validation: validate the entries of arrays of strings (#​47194) (e49ca6a)
• config: document all valid customDatasources[].formats (#​47204) (a19c6bc)
• workers/repository/init: massage inherited config before validating (#​47201) (2a3a481)
• workers/repository/init: massage static repo config before validating (#​47202) (fea2346)

Miscellaneous Chores

• deps: update jdx/mise-action action to v5.2.2 (main) (#​47250) (719bd35)

Code Refactoring

• util/exec: use isContainerbase from the base image package directly (#​47247) (dff2bd5)

Tests

• workers/repository/init: document validation of unmassaged config (#​47200) (de17a09)

Build System

• deps: update node.js to v24.22.1 (main) (#​47253) (9222a5d)

nodejs/node (node)

v26.12.1: 2026-10-21, Version 26.12.1 (Current), @​aduh95 prepared by @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
• (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
• (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
• deps: V8: backport 93cd21e (Joyee Cheung)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• tls: reject chains containing blocked public keys (Ulises Gascon)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
• crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

• [818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #​66877
• [fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
• [acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #​66721
• [12daa54d2e] - deps: V8: backport 93cd21e (Joyee Cheung) nodejs-private/node-private#999
• [6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #​66868
• [a6040b50d9] - deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #​66786
• [cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #​66871
• [ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #​66855
• [745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.