Skip to content

[v22.x backport] deps: update nghttp2 to 1.69.0#63195

Open
mcollina wants to merge 8 commits into
nodejs:v22.x-stagingfrom
mcollina:nghttp2-main-updates-v22.x-staging
Open

[v22.x backport] deps: update nghttp2 to 1.69.0#63195
mcollina wants to merge 8 commits into
nodejs:v22.x-stagingfrom
mcollina:nghttp2-main-updates-v22.x-staging

Conversation

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/http2
  • @nodejs/net
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added http2 Issues or PRs related to the http2 subsystem. needs-ci PRs that need a full CI run. v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch. labels May 8, 2026
@aduh95 aduh95 changed the title Nghttp2 main updates v22.x staging [v22.x backport] deps: update nghttp2 to 1.69.0 May 8, 2026
@aduh95
Copy link
Copy Markdown
Contributor

aduh95 commented May 8, 2026

You would need #58293, but that's labelled semver-major

@mcollina
Copy link
Copy Markdown
Member Author

mcollina commented May 8, 2026

We need to backport this update due to GHSA-6933-cjhr-5qg6. I assume we don't want to float a patch on top of nghttp2, which also would not please security scanners.

@marco-ippolito
Copy link
Copy Markdown
Member

The failing tests are not flakes

@mcollina mcollina force-pushed the nghttp2-main-updates-v22.x-staging branch from f1cb842 to 3e417f5 Compare May 11, 2026 15:33
@mcollina
Copy link
Copy Markdown
Member Author

I pushed up the wrong commit

@aduh95 aduh95 force-pushed the nghttp2-main-updates-v22.x-staging branch from 3e417f5 to cf3a0a2 Compare May 26, 2026 09:56
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

mcollina and others added 8 commits May 26, 2026 12:28
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://datatracker.ietf.org/doc/html/rfc9113#section-5.3.1
PR-URL: nodejs#58293
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
PR-URL: nodejs#58669
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
PR-URL: nodejs#57269
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#58786
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: nodejs#59790
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
PR-URL: nodejs#61136
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#62891
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#62891
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@aduh95 aduh95 force-pushed the nghttp2-main-updates-v22.x-staging branch 2 times, most recently from 5cd9919 to d13afce Compare May 26, 2026 10:33
@aduh95 aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. label May 26, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 26, 2026
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

@aduh95 aduh95 added the dependencies Pull requests that update a dependency file. label Jun 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file. http2 Issues or PRs related to the http2 subsystem. needs-ci PRs that need a full CI run. v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants