[gominimal-pkgmgr-mgr]

Update node 25.8.2 → 26.10.0

Source: github:nodejs/node:operator-pinned
Release: https://github.com/nodejs/node/releases/tag/v26.10.0
Changelog: nodejs/node@v25.8.2...v26.10.0
Released: 1 days ago (2026-09-22)

Warning

Pkgscan: 1 new signal introduced by this update (risk score 2.0).
Diff against the prior version surfaced patterns that weren't present before. Review carefully before merging — supply-chain attacks land via version-bump injection.

Severity	File	Line	Capability (MBC)	Pattern
MEDIUM	deps/icu-small/source/data/in/icudt78l.dat.bz2	0	anti-static-analysis/embedded-blob	bzip2 archive

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)

	Component	Old	New
~	node	25.8.2	26.10.0
~	node-upstream	25.8.2	26.10.0

Changes

	Old	New
Version	25.8.2	26.10.0
SHA256	f4351a409f84e94c...	dadc307a53537067...
Size	131.1 MB	139.7 MB
Source	gs://minimal-staging-archives/node-25.8.2.tar.gz	gs://minimal-staging-archives/node-26.10.0.tar.gz

---

Created by pkgmgr

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 1b931883-82c1-408f-b020-322c28b0ef9d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}