The most serious of these, CVE-2026-111497, is in Node's Brotli decompression. AirTrail never decompresses user-supplied data and only makes requests to fixed upstream services, so exploiting it would require compromising one of those services. Updating is still recommended.
The other fixes cover DNS lookups, TLS certificate checks for IP addresses, crypto snapshots, the permission model and the HTTP client agent. AirTrail doesn't use the affected parts of Node, so these don't apply.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [johly/airtrail](https://github.com/johanohly/AirTrail) | patch | `v3.13.0` → `v3.13.1` |
---
### Release Notes
<details>
<summary>johanohly/AirTrail (johly/airtrail)</summary>
### [`v3.13.1`](https://github.com/johanohly/AirTrail/releases/tag/v3.13.1)
[Compare Source](https://github.com/johanohly/AirTrail/compare/v3.13.0...v3.13.1)
This release rebuilds the Docker image on Node.js 22.23.4, which fixes the [October 2026 Node.js security vulnerabilities](https://nodejs.org/en/blog/release/v22.23.4). There are no changes to AirTrail itself.
The most serious of these, `CVE-2026-111497`, is in Node's Brotli decompression. AirTrail never decompresses user-supplied data and only makes requests to fixed upstream services, so exploiting it would require compromising one of those services. Updating is still recommended.
The other fixes cover DNS lookups, TLS certificate checks for IP addresses, crypto snapshots, the permission model and the HTTP client agent. AirTrail doesn't use the affected parts of Node, so these don't apply.
**Full Changelog**: <https://github.com/johanohly/AirTrail/compare/v3.13.0...v3.13.1>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS41IiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v3.13.0→v3.13.1Release Notes
johanohly/AirTrail (johly/airtrail)
v3.13.1Compare Source
This release rebuilds the Docker image on Node.js 22.23.4, which fixes the October 2026 Node.js security vulnerabilities. There are no changes to AirTrail itself.
The most serious of these,
CVE-2026-111497, is in Node's Brotli decompression. AirTrail never decompresses user-supplied data and only makes requests to fixed upstream services, so exploiting it would require compromising one of those services. Updating is still recommended.The other fixes cover DNS lookups, TLS certificate checks for IP addresses, crypto snapshots, the permission model and the HTTP client agent. AirTrail doesn't use the affected parts of Node, so these don't apply.
Full Changelog: https://github.com/johanohly/AirTrail/compare/v3.13.0...v3.13.1
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.