nodejs-github-bot · Oct 20, 2026
diff --git a/deps/cares/CMakeLists.txt b/deps/cares/CMakeLists.txt
@@ -12,7 +12,7 @@ INCLUDE (CheckCSourceCompiles)
 INCLUDE (CheckStructHasMember)
 INCLUDE (CheckLibraryExists)
 
-PROJECT (c-ares LANGUAGES C VERSION "1.34.8" )
+PROJECT (c-ares LANGUAGES C VERSION "1.34.9" )
 
 # Set this version before release
 SET (CARES_VERSION "${PROJECT_VERSION}")
@@ -30,7 +30,7 @@ INCLUDE (GNUInstallDirs) # include this *AFTER* PROJECT(), otherwise paths are w
 # For example, a version of 4:0:2 would generate output such as:
 #    libname.so   -> libname.so.2
 #    libname.so.2 -> libname.so.2.2.0
-SET (CARES_LIB_VERSIONINFO "21:7:19")
+SET (CARES_LIB_VERSIONINFO "21:8:19")
 
 
 OPTION (CARES_STATIC        "Build as a static library"                                             OFF)
@@ -328,10 +328,21 @@ ENDIF ()
 SET (ORIG_CMAKE_REQUIRED_DEFINITIONS ${CMAKE_REQUIRED_DEEFINITIONS})
 SET (ORIG_CMAKE_REQUIRED_LIBRARIES ${CMAKE_REQUIRED_LIBRARIES})
 SET (ORIG_CMAKE_EXTRA_INCLUDE_FILES ${CMAKE_EXTRA_INCLUDE_FILES})
+SET (ORIG_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
 
 SET (CMAKE_REQUIRED_DEFINITIONS ${SYSFLAGS})
 LIST (APPEND CMAKE_REQUIRED_LIBRARIES ${CARES_DEPENDENT_LIBS})
 
+# Apple SDKs declare functions newer than the deployment target.  The build
+# rejects calls to them with -Werror=partial-availability, so the symbol
+# checks must too, or they report functions the build cannot use.
+IF (APPLE)
+	CHECK_C_COMPILER_FLAG (-Werror=partial-availability HAVE_WERROR_PARTIAL_AVAILABILITY)
+	IF (HAVE_WERROR_PARTIAL_AVAILABILITY)
+		SET (CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -Werror=partial-availability")
+	ENDIF ()
+ENDIF ()
+
 MACRO (CARES_EXTRAINCLUDE_IFSET var include)
 	IF (${var})
 		LIST (APPEND CMAKE_EXTRA_INCLUDE_FILES ${include})
@@ -494,6 +505,7 @@ CHECK_FUNCTION_EXISTS (__system_property_get HAVE___SYSTEM_PROPERTY_GET)
 SET (CMAKE_REQUIRED_DEFINITIONS ${ORIG_CMAKE_REQUIRED_DEEFINITIONS})
 SET (CMAKE_REQUIRED_LIBRARIES ${ORIG_CMAKE_REQUIRED_LIBRARIES})
 SET (CMAKE_EXTRA_INCLUDE_FILES ${ORIG_CMAKE_EXTRA_INCLUDE_FILES})
+SET (CMAKE_REQUIRED_FLAGS ${ORIG_CMAKE_REQUIRED_FLAGS})
 
 
 ################################################################################

diff --git a/deps/cares/RELEASE-NOTES.md b/deps/cares/RELEASE-NOTES.md
@@ -1,3 +1,104 @@
+## c-ares version 1.34.9 - October 19 2026
+
+This is a security release.
+
+Security:
+* Memory corruption when an application cancels its lookups after a
+  connection failure. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-wpr3-8q3r-4q8c
+* A DNS reply that arrived from a different server than the one queried could
+  be accepted. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44
+* Use-after-free of a lookup after shutting down a failed connection. Please
+  see https://github.com/c-ares/c-ares/security/advisories/GHSA-97vq-4mxv-7vhm
+* Use-after-free when an application cancels lookups from a callback, or shuts
+  a channel down. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh
+* Use-after-free of a connection after the socket-state callback returns.
+  Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-mw23-pfg6-2x9r
+* Use-after-free when an application cancels lookups from a server-state
+  callback. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-v33j-65h4-4ch8
+* Use-after-free of a server record when an application changes its DNS
+  servers from a callback. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-pj7p-v3cw-hq66
+* Use-after-free of a cached DNS answer while the application is still reading
+  it. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-grv7-fq5q-9vfc
+* Buffer overflow when `ares_dup()` or `ares_save_options()` runs while
+  another thread changes the servers. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v
+* Uninitialized memory returned for a numeric IPv6 name with a prefix length.
+  Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r
+* The query cache could return an answer obtained using different EDNS
+  options. Please see
+  https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh
+
+Changes:
+* Answers served from the query cache now report their remaining TTL rather
+  than the TTL originally received.
+* `ares_inet_pton()` rejects a "/bits" prefix length and returns 0, rather
+  than -1, for any input it cannot parse.
+* UDP replies must now come from the server's port as well as its address.
+  Custom `arecvfrom` socket functions (`ares_set_socket_functions_ex()` or
+  `ares_set_socket_functions()`) must fill in the full source address,
+  including the port. For compatibility, a reported port of 0 checks only the
+  address, but such implementations are insecure and should be fixed.
+  [PR #1370](https://github.com/c-ares/c-ares/pull/1370)
+* Document that socket functions and socket, configure and pending-write
+  callbacks must not call c-ares functions on the same channel.
+  [PR #1360](https://github.com/c-ares/c-ares/pull/1360)
+
+Bugfixes:
+* `ares_dup()`: don't leave the new channel bound to the source channel.
+  [PR #1333](https://github.com/c-ares/c-ares/pull/1333)
+* `ares_init_options()`: don't report the default query cache as a caller-set
+  option. [PR #1354](https://github.com/c-ares/c-ares/pull/1354)
+* Clamp DNS record TTLs to the signed int range used by public APIs.
+  [PR #1313](https://github.com/c-ares/c-ares/pull/1313)
+* `ares_dns_write()`: reject messages larger than 64KB.
+  [PR #1314](https://github.com/c-ares/c-ares/pull/1314)
+* `ares_dns_parse()`: accept legacy compressed RDATA names.
+  [PR #1326](https://github.com/c-ares/c-ares/pull/1326)
+* `ares_parse_a_reply()`/`ares_parse_aaaa_reply()`: ignore a negative
+  `*naddrttls`. [PR #1302](https://github.com/c-ares/c-ares/pull/1302)
+* select event backend: refuse descriptors >= `FD_SETSIZE` instead of
+  overflowing `fd_set`. [PR #1312](https://github.com/c-ares/c-ares/pull/1312)
+* Strip inline comments from resolv.conf values.
+  [PR #1276](https://github.com/c-ares/c-ares/pull/1276)
+* Ignore absurd resolv.conf retry/attempts values.
+  [PR #1315](https://github.com/c-ares/c-ares/pull/1315)
+* Zero-initialize the server config when parsing nameserver URIs.
+  [PR #1325](https://github.com/c-ares/c-ares/pull/1325)
+* URI parsing: roll back the ':' probe when it lands past the '@'.
+  [PR #1265](https://github.com/c-ares/c-ares/pull/1265)
+* Do not assume `gethostname()` NUL-terminates its buffer.
+  [PR #1269](https://github.com/c-ares/c-ares/pull/1269)
+* Combine the hash table seed with XOR instead of OR.
+  [PR #1330](https://github.com/c-ares/c-ares/pull/1330)
+* Turn off stdio buffering when loading a file.
+  [PR #939](https://github.com/c-ares/c-ares/pull/939)
+* Guard `pipe2()` on Apple platforms to prevent unguarded availability
+  warnings. [PR #1328](https://github.com/c-ares/c-ares/pull/1328)
+
+Thanks go to these friendly people for their efforts and contributions for this
+release:
+
+* (@ahillspace)
+* (@anon5376)
+* Brad House (@bradh352)
+* Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
+* Dev (@devdgna)
+* (@evilgensec)
+* Ilias (@iliasabk)
+* (@jdymitarai)
+* (@jmestwa-coder)
+* Manohar Paturi (@ManoharPaturi)
+* (@mardgez13)
+
+
 ## c-ares version 1.34.8 - July 7 2026
 
 This is a bugfix release.

diff --git a/deps/cares/aminclude_static.am b/deps/cares/aminclude_static.am
@@ -1,6 +1,6 @@
 
 # aminclude_static.am generated automatically by Autoconf
-# from AX_AM_MACROS_STATIC on Tue Jul  7 16:14:13 UTC 2026
+# from AX_AM_MACROS_STATIC on Tue Oct 20 02:31:56 UTC 2026
 
 
 # Code coverage

diff --git a/deps/cares/configure b/deps/cares/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for c-ares 1.34.8.
+# Generated by GNU Autoconf 2.71 for c-ares 1.34.9.
 #
 # Report bugs to <c-ares mailing list: http://lists.haxx.se/listinfo/c-ares>.
 #
@@ -621,8 +621,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='c-ares'
 PACKAGE_TARNAME='c-ares'
-PACKAGE_VERSION='1.34.8'
-PACKAGE_STRING='c-ares 1.34.8'
+PACKAGE_VERSION='1.34.9'
+PACKAGE_STRING='c-ares 1.34.9'
 PACKAGE_BUGREPORT='c-ares mailing list: http://lists.haxx.se/listinfo/c-ares'
 PACKAGE_URL=''
 
@@ -1430,7 +1430,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures c-ares 1.34.8 to adapt to many kinds of systems.
+\`configure' configures c-ares 1.34.9 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1501,7 +1501,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of c-ares 1.34.8:";;
+     short | recursive ) echo "Configuration of c-ares 1.34.9:";;
    esac
   cat <<\_ACEOF
 
@@ -1647,7 +1647,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-c-ares configure 1.34.8
+c-ares configure 1.34.9
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2271,7 +2271,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by c-ares $as_me 1.34.8, which was
+It was created by c-ares $as_me 1.34.9, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3245,7 +3245,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 
-CARES_VERSION_INFO="21:7:19"
+CARES_VERSION_INFO="21:8:19"
 
 
 
@@ -6818,7 +6818,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='c-ares'
- VERSION='1.34.8'
+ VERSION='1.34.9'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -23381,6 +23381,95 @@ fi
 
 
 
+if test "x$host_vendor" = "xapple"
+then :
+
+  cares_save_cflags="$CFLAGS"
+
+
+
+
+for flag in -Werror=partial-availability; do
+  as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts $flag" >&5
+printf %s "checking whether the C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  if test x"$GCC" = xyes ; then
+    add_gnu_werror="-Werror"
+  fi
+  CFLAGS="$CFLAGS  $flag $add_gnu_werror"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main (void)
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  eval "$as_CACHEVAR=yes"
+else $as_nop
+  eval "$as_CACHEVAR=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+eval ac_res=\$$as_CACHEVAR
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
+
+if test ${CFLAGS+y}
+then :
+
+  case " $CFLAGS " in #(
+  *" $flag "*) :
+    { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+  (: CFLAGS already contains $flag) 2>&5
+  ac_status=$?
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } ;; #(
+  *) :
+
+     as_fn_append CFLAGS " $flag"
+     { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+  (: CFLAGS="$CFLAGS") 2>&5
+  ac_status=$?
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+     ;;
+esac
+
+else $as_nop
+
+  CFLAGS=$flag
+  { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+  (: CFLAGS="$CFLAGS") 2>&5
+  ac_status=$?
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+
+fi
+
+else $as_nop
+  :
+fi
+
+done
+
+
+fi
+
 ac_fn_check_decl "$LINENO" "strnlen" "ac_cv_have_decl_strnlen" "$cares_all_includes
 " "$ac_c_undeclared_builtin_options" "CFLAGS"
 if test "x$ac_cv_have_decl_strnlen" = xyes
@@ -23781,6 +23870,12 @@ then :
 printf "%s\n" "#define HAVE___SYSTEM_PROPERTY_GET 1" >>confdefs.h
 
 fi
+if test "x$host_vendor" = "xapple"
+then :
+
+  CFLAGS="$cares_save_cflags"
+
+fi
 
 
 
@@ -28238,7 +28333,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by c-ares $as_me 1.34.8, which was
+This file was extended by c-ares $as_me 1.34.9, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -28306,7 +28401,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-c-ares config.status 1.34.8
+c-ares config.status 1.34.9
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 

diff --git a/deps/cares/configure.ac b/deps/cares/configure.ac
@@ -2,10 +2,10 @@ dnl Copyright (C) The c-ares project and its contributors
 dnl SPDX-License-Identifier: MIT
 AC_PREREQ([2.69])
 
-AC_INIT([c-ares], [1.34.8],
+AC_INIT([c-ares], [1.34.9],
   [c-ares mailing list: http://lists.haxx.se/listinfo/c-ares])
 
-CARES_VERSION_INFO="21:7:19"
+CARES_VERSION_INFO="21:8:19"
 dnl This flag accepts an argument of the form current[:revision[:age]]. So,
 dnl passing -version-info 3:12:1 sets current to 3, revision to 12, and age to
 dnl 1.
@@ -551,6 +551,14 @@ dnl https://mailman.videolan.org/pipermail/vlc-devel/2015-March/101802.html
 dnl which would require we check each individually and provide function arguments
 dnl for the test.
 
+dnl On Apple hosts, header availability macros declare functions newer than the
+dnl deployment target.  Ensure -Werror=partial-availability is used during
+dnl declaration checks so too-new symbols are correctly reported as missing.
+AS_IF([test "x$host_vendor" = "xapple"], [
+  cares_save_cflags="$CFLAGS"
+  AX_APPEND_COMPILE_FLAGS([-Werror=partial-availability], [CFLAGS])
+])
+
 AC_CHECK_DECL(strnlen,         [AC_DEFINE([HAVE_STRNLEN],           1, [Define to 1 if you have `strnlen`]        )], [], $cares_all_includes)
 AC_CHECK_DECL(memmem,          [AC_DEFINE([HAVE_MEMMEM],            1, [Define to 1 if you have `memmem`]         )], [], $cares_all_includes)
 AC_CHECK_DECL(recv,            [AC_DEFINE([HAVE_RECV],              1, [Define to 1 if you have `recv`]           )], [], $cares_all_includes)
@@ -601,6 +609,9 @@ AC_CHECK_DECL(ConvertInterfaceLuidToNameA, [AC_DEFINE([HAVE_CONVERTINTERFACELUID
 AC_CHECK_DECL(NotifyIpInterfaceChange,     [AC_DEFINE([HAVE_NOTIFYIPINTERFACECHANGE],     1, [Define to 1 if you have `NotifyIpInterfaceChange`]    )], [], $cares_all_includes)
 AC_CHECK_DECL(RegisterWaitForSingleObject, [AC_DEFINE([HAVE_REGISTERWAITFORSINGLEOBJECT], 1, [Define to 1 if you have `RegisterWaitForSingleObject`])], [], $cares_all_includes)
 AC_CHECK_DECL(__system_property_get,       [AC_DEFINE([HAVE___SYSTEM_PROPERTY_GET],       1, [Define to 1 if you have `__system_property_get`]      )], [], $cares_all_includes)
+AS_IF([test "x$host_vendor" = "xapple"], [
+  CFLAGS="$cares_save_cflags"
+])
 
 
 dnl ###############################################################################