SUSE-SU-2026:5037-1: Security update for nodejs24

This update for nodejs24 fixes the following issues:

Security issues fixed:

- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565). - CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561). - CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562). - CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563). - CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566). - CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570). - CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567). - CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

- 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

- Update to 24.22.1: - crypto: update root certificates to NSS 3.131.1 - deps: update c-ares to 1.34.9 - deps: update timezone to 2026e - deps: upgrade openssl sources to openssl-3.5.9 - deps: update undici to 7.30.1 - Update to 24.22.0: - crypto: add crypto.parsePKCS12() - crypto: discover ciphers and hashes from OpenSSL providers - crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs - doc: deprecate Server.prototype.listen2 in node:net - net: support sending net.BoundSocket to threads and child processes - perfhooks: implement SlidingWindowHistogram - perfhooks: implement qrde analysis support in Histogram - perfhooks: implement Histogram meanCI API - perfhooks: add CBOR export/import for histogram exchange - sqlite: add StatementSync.prototype.close() - sqlite: add StatementSync.prototypeSymbol.dispose - src,lib: add util.markPromiseAsHandled - util: implement util.throttle - util: implement debounce - Update to 24.21.0: - crypto: update root certificates to NSS 3.126 - crypto: support loading private keys through STORE loaders - deps: update Undici to 7.29.1 - lib,src: improve histogram implementation - net: improve performance of net.BlockList - perfhooks: add statistical hypothesis testing to histogram - util: add non-throwing MIMEType.parse - Update to 24.20.0: - asynchooks: add using scopes to AsyncLocalStorage - buffer: add end parameter - doc: add MikeMcC399 as collaborator - lib,permission: add permission.drop - loader: implement package maps - src,permission: add --permission-audit - stream: add node:stream/iter implementation - testrunner: add context.log() and test:log event - testrunner: report entryFile in TestStream events - wasm: enable JSPI - Update to 24.19.0: - buffer: implement blob.textStream() - deps: update OpenSSL build config to support compression - doc: update blockList stability status to release candidate - doc: mark stream.compose stable - esm: add --experimental-import-text flag - fs: support caller-supplied readFile() buffers - http: add httpValidation option to configure header value validation - net: support TCPKEEPINTVL and TCPKEEPCNT in setKeepAlive - perfhooks: sample delay per event loop iteration - src: allow empty --experimental-config-file - stream: expose ReadableStreamTee - tls: report negotiated TLS groups - tls: add certificateCompression option