[Hector Hernandez (hectorhdzg)]

Summary

• Require patched Node.js releases (22.23.4+, 24.22.1+, or 26.12.1+ within their supported major lines) for repository builds.
• Remove EOL Node 18/20 CI jobs, check for current patches rather than reusing vulnerable cached versions, and explicitly select patched Node 24 for CodeQL and Pages.
• Add npm/Rush runtime constraints, a local .nvmrc, and contributor guidance for CVE-2026-111497 and separately managed runner runtimes.

Recent CI logs showed Node 22.23.3 and 24.21.0, below the security fixes, as well as EOL Node 18/20. This is build/install/runtime hardening; browser SDK gzip compression is unchanged.

Validation

• Passed 19 release/prerelease boundary checks and verified npm, Rush, and .nvmrc agree.
• Verified npm's engine checker rejects affected versions and accepts the three patched minimums.
• Parsed and checked all three workflow configurations, including setup-before-install ordering and check-latest.
• Passed existing PURE annotation normalization tests and git diff --check.
• Full Rush/lint validation is blocked: restoring dependencies fails because the existing pnpm@10.34.5 pin is unavailable from the configured registry. Direct Grunt execution skips ESLint on Node 24 under the existing configuration.

Operational follow-up

JavaScript actions use the runner's bundled Node runtime independently of actions/setup-node. Those runtimes, private release agents, and external container images still require provisioning-side patch verification; this PR does not claim to update them.

[Copilot]

🔵 Needs a closer look

Blocked dependency restoration leaves full install, build, and lint compatibility unverified across the newly required runtimes.

No open issues 🎉

What changed in this PR

This PR hardens repository builds by requiring patched Node.js runtimes without changing browser SDK compatibility or telemetry compression.

Changes:

• Add matching npm and Rush runtime constraints, strict npm engine checks, and a local Node version default.
• Replace Node 18/20 CI jobs with supported runtime ranges and enable latest-patch selection.
• Document security minimums and separate patching responsibilities for action runtimes and release infrastructure.

File	Description
rush.json	Require patched Node versions for Rush tooling.
package.json	Declare matching Node engine requirements.
CONTRIBUTING.md	Document runtime requirements and infrastructure patching responsibilities.
.nvmrc	Select Node 24.22.1 for local development.
.npmrc	Enable strict npm engine enforcement.
.github/​workflows/​jekyll-gh-pages.yml	Explicitly select patched Node 24 with latest-patch checks.
.github/​workflows/​codeql-analysis.yml	Update the configured Node runtime to patched Node 24.
.github/​workflows/​ci.yml	Test patched Node 22/24/26 ranges with latest-patch checks.

_{Review effort: Balanced}