- Wrapped SNICallback in try/catch and added timing‑safe HMAC/KMAC comparisons, null‑prototype header objects, and permission checks for pipe, realpath.native, and fs/promises to address several high‑severity CVEs
- Fixed URL handling crashes, NGHTTP2 flow‑control errors, and added tests for array‑index hash collisions
- Updated dependencies: Undici to 7.24.4, npm to 11.11.1, and V8 depot tools version