chore(deps): update node.js to v26.5.1

[renovate]

This PR contains the following updates:

Package	Update	Change
node (source)	patch	26.5.0 → 26.5.1

This changes the Node version CI runs on, not just a local hint. Run pnpm run verify locally on the proposed version before merging.

---

Release Notes

nodejs/node (node)

v26.5.1: 2026-07-29, Version 26.5.1 (Current), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 8.9.0 (Node.js GitHub Bot)

Commits

• [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #​64712
• [dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908
• [3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924
• [d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.