chore(deps): update node.js to v22.23.2

[renovate]

This PR contains the following updates:

Package	Update	Change
node (source)	patch	22.23.1 → 22.23.2

---

Release Notes

nodejs/node (node)

v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 6.28.0 (Node.js GitHub Bot)

Commits

• [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #​64714
• [22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932
• [daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #​63752
• [51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934
• [acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	1.13s
✅ EDITORCONFIG	editorconfig-checker	1		0	0	0.15s
✅ REPOSITORY	git_diff	yes		no	no	0.14s
✅ REPOSITORY	secretlint	yes		no	no	0.43s
✅ REPOSITORY	syft	yes		no	no	2.52s
✅ REPOSITORY	trivy	yes		no	no	8.51s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.94s
✅ REPOSITORY	trufflehog	yes		no	no	20.4s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff