Skip to content

[v22.x backport] deps: update nghttp2 to 1.69.0#63195

Open
mcollina wants to merge 10 commits intonodejs:v22.x-stagingfrom
mcollina:nghttp2-main-updates-v22.x-staging
Open

[v22.x backport] deps: update nghttp2 to 1.69.0#63195
mcollina wants to merge 10 commits intonodejs:v22.x-stagingfrom
mcollina:nghttp2-main-updates-v22.x-staging

Conversation

@mcollina
Copy link
Copy Markdown
Member

@mcollina mcollina commented May 8, 2026

No description provided.

nodejs-github-bot and others added 8 commits May 7, 2026 23:01
PR-URL: nodejs#57269
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
(cherry picked from commit d74daea)
PR-URL: nodejs#58786
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
(cherry picked from commit 745f48d)
PR-URL: nodejs#59790
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
(cherry picked from commit 43eb6cb)
This commit reverts "Make error handling robust".
Without this revert, we are getting timeouts, crashes, and different
error codes in `parallel/test-http2-*`.

Refs: nghttp2/nghttp2@7784fa9
PR-URL: nodejs#59790
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
(cherry picked from commit 408aba6)
PR-URL: nodejs#61136
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
(cherry picked from commit 1d54921)
This commit reverts "Make error handling robust".
Without this revert, we are getting timeouts, crashes, and different
error codes in `parallel/test-http2-*`.

Refs: nghttp2/nghttp2@7784fa9
Refs: nodejs#60661
PR-URL: nodejs#61136
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
(cherry picked from commit fb2a02f)
PR-URL: nodejs#62891
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
(cherry picked from commit 5320a1b)
This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#62891
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
(cherry picked from commit 4a32c00)
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/http2
  • @nodejs/net
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added http2 Issues or PRs related to the http2 subsystem. needs-ci PRs that need a full CI run. v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch. labels May 8, 2026
@aduh95 aduh95 changed the title Nghttp2 main updates v22.x staging [v22.x backport] deps: update nghttp2 to 1.69.0 May 8, 2026
@aduh95
Copy link
Copy Markdown
Contributor

aduh95 commented May 8, 2026

You would need #58293, but that's labelled semver-major

@mcollina
Copy link
Copy Markdown
Member Author

mcollina commented May 8, 2026

We need to backport this update due to GHSA-6933-cjhr-5qg6. I assume we don't want to float a patch on top of nghttp2, which also would not please security scanners.

mcollina and others added 2 commits May 8, 2026 22:34
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://datatracker.ietf.org/doc/html/rfc9113#section-5.3.1
PR-URL: nodejs#58293
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
(cherry picked from commit a631264)
PR-URL: nodejs#54869
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
(cherry picked from commit 0368f2f)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

http2 Issues or PRs related to the http2 subsystem. needs-ci PRs that need a full CI run. v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants