Review requested:

• @nodejs/security-wg

CI: https://ci.nodejs.org/job/node-test-pull-request/72490/

CI: https://ci.nodejs.org/job/node-test-pull-request/72498/

CI: https://ci.nodejs.org/job/node-test-pull-request/72506/

- Loading data for nodejs/node/pull/62595
✔  Done loading data for nodejs/node/pull/62595
----------------------------------- PR info ------------------------------------
Title      deps: update ngtcp2 to 1.22.0 (#62595)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     nodejs-github-bot:actions/tools-update-ngtcp2 -> nodejs:main
Labels     author ready, needs-ci, quic, dependencies, dont-land-on-v20.x, dont-land-on-v22.x, dont-land-on-v24.x
Commits    1
 - deps: update ngtcp2 to 1.22.0
Committers 1
 - github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/62595
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/62595
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sun, 05 Apr 2026 00:57:46 GMT
   ✔  Approvals: 1
   ✔  - Antoine du Hamel (@aduh95) (TSC): https://github.com/nodejs/node/pull/62595#pullrequestreview-4059581802
   ✘  This PR needs to wait 120 more hours to land (or 0 minutes if there is one more approval)
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-04-06T10:24:28Z: https://ci.nodejs.org/job/node-test-pull-request/72506/
- Querying data for job/node-test-pull-request/72506/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

Landed in 586403f

This bump breaks building with --experimental-quic on main for me (cc @jasnell). I think this is because the ngtcp2 example code has upgraded to require C++23 for v1.22+: ngtcp2/ngtcp2@9206863.

Fails with:

FAILED: obj/deps/ngtcp2/ngtcp2/examples/ngtcp2_test_server.tls_session_base_ossl.o 
ccache g++ -MMD -MF obj/deps/ngtcp2/ngtcp2/examples/ngtcp2_test_server.tls_session_base_ossl.o.d -D_U_= -D_GLIBCXX_USE_CXX11_ABI=1 -D_FILE_OFFSET_BITS=64 -DNODE_OPENSSL_CONF_NAME=nodejs_conf -DICU_NO_USER_DATA_OVERRIDE -D__STDC_FORMAT_MACROS -DOPENSSL_NO_PINSHARED -DOPENSSL_THREADS -DHAVE_CONFIG_H -DWITH_EXAMPLE_OSSL -DEV_STANDALONE=1 -DHAVE_UNISTD_H -DHAVE_ARPA_INET_H -DHAVE_NETINET_IN_H -DHAVE_NETINET_IP_H -DNGTCP2_STATICLIB -DQUIC_NGTCP2_USE_OPENSSL_3_5 -DNGHTTP3_STATICLIB -DNDEBUG -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_BUILDING_OPENSSL -DAES_ASM -DBSAES_ASM -DCMLL_ASM -DECP_NISTZ256_ASM -DGHASH_ASM -DKECCAK1600_ASM -DMD5_ASM -DOPENSSL_BN_ASM_GF2m -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DPADLOCK_ASM -DPOLY1305_ASM -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DX25519_ASM -DOPENSSL_PIC -I../../deps/ngtcp2 -I../../deps/ngtcp2/ngtcp2/examples -I../../deps/ngtcp2/ngtcp2/lib/includes -I../../deps/ngtcp2/ngtcp2/crypto/includes -I../../deps/ngtcp2/ngtcp2/third-party/urlparse -I../../deps/ngtcp2/ngtcp2/third-party/libev -I../../nghttp2/lib -I../../deps/ngtcp2/ngtcp2/lib/includes -I../../deps/ngtcp2/ngtcp2/crypto/includes -I../../deps/ngtcp2/ngtcp2/crypto -I../../deps/ngtcp2/nghttp3/lib/includes -I../../deps/openssl/openssl/include -I../../deps/openssl/openssl/crypto/include -I../../deps/openssl/config/archs/linux-x86_64/asm/include -I../../deps/openssl/config/archs/linux-x86_64/asm -I../../deps/nghttp2/lib/includes -pthread -Wall -Wextra -Wno-unused-parameter -Wno-everything -m64 -O3 -fno-omit-frame-pointer -ffile-prefix-map=/home/tim/Dropbox/programming/javascript/node/=./ -fno-rtti -fno-exceptions -fno-strict-aliasing -std=gnu++20  -c ../../deps/ngtcp2/ngtcp2/examples/tls_session_base_ossl.cc -o obj/deps/ngtcp2/ngtcp2/examples/ngtcp2_test_server.tls_session_base_ossl.o
In file included from ../../deps/ngtcp2/ngtcp2/examples/util.h:51,
                 from ../../deps/ngtcp2/ngtcp2/examples/tls_session_base_ossl.cc:29:
../../deps/ngtcp2/ngtcp2/examples/shared.h:35:10: fatal error: print: No such file or directory
   35 | #include <print>
      |          ^~~~~~~
compilation terminated.

We are building that example code intentionally, it's used in the QUIC test suite, added in #59946. I'm not sure what the best fix is here - is it practical for us to upgrade to C++23 for this, or do we need a floating patch to preserve C++20 compatibility, or to pin/fork the example server & client from v1.21 or something?

This should not have been landed with that difference. For now, I think our only option is to disable building the ngtcp2 examples until we can identify a better approach

Specifically, we can't upgrade to C++23 for this one experimental feature.

In general, please do not land updates to ngtcp2 and nghttp3 without someone who is working on the quic work reviewing and signing off first. These updates can actively break/conflict with work in progress.

@jasnell Is there a GH team for quic that could be added to CODEOWNERS for those deps? It wouldn't block the updates from landing, but at least would ping collaborators on such a team for awareness.

Is there a GH team for quic that could be added to CODEOWNERS for those deps? It wouldn't block the updates from landing, but at least would ping collaborators on such a team for awareness.

There is (@nodejs/quic) I didn't realise this wasn't hooked up. I'll open a PR to update CODEOWNERS.

EDIT: Done #62652

This bump breaks building with --experimental-quic on main for me

Specifically, if kept, this bumps the gcc build requirement to >=14.1. (I believe Clangists are OK.)