From 67d416bb016375bb0c77feede69b54eb6c0e3a89 Mon Sep 17 00:00:00 2001 From: Hector Hernandez <39923391+hectorhdzg@users.noreply.github.com> Date: Fri, 23 Oct 2026 11:10:47 -0700 Subject: [PATCH 1/2] fix: require patched Node runtimes for repository builds Use supported Node security floors for CI, CodeQL, Pages, npm, and Rush. Resolve current patches instead of accepting vulnerable cached runtimes and document runner provisioning requirements. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 3 ++- .github/workflows/codeql-analysis.yml | 3 ++- .github/workflows/jekyll-gh-pages.yml | 5 +++-- .npmrc | 1 + .nvmrc | 1 + CONTRIBUTING.md | 17 +++++++++++++++++ package.json | 3 +++ rush.json | 1 + 8 files changed, 30 insertions(+), 4 deletions(-) create mode 100644 .npmrc create mode 100644 .nvmrc diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9fc7d901d..60148d84a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,7 @@ jobs: strategy: matrix: - node-version: [ 18, 20, 22, 24 ] + node-version: [ '>=22.23.4 <23', '>=24.22.1 <25', '>=26.12.1 <27' ] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -37,6 +37,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node-version }} + check-latest: true - name: Update rush shrinkwrap dependencies (for different node versions) run: node common/scripts/install-run-rush.js update --full --recheck - run: npm install rollup -g diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 563ea506a..7e19d830a 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -40,7 +40,7 @@ jobs: - language: actions - language: javascript - language: javascript-typescript - node-version: '18' + node-version: '>=24.22.1 <25' # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' # Use `c-cpp` to analyze code written in C, C++ or both # Use 'java-kotlin' to analyze code written in Java, Kotlin or both @@ -61,6 +61,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node-version }} + check-latest: true # Install dependencies for JavaScript projects - name: Install dependencies diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index d96b1263e..8e3cd4707 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -28,10 +28,11 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Use Node.js ${{ matrix.node-version }} + - name: Use patched Node.js LTS uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ matrix.node-version }} + node-version: '>=24.22.1 <25' + check-latest: true - name: Update rush shrinkwrap dependencies (for different node versions) run: node common/scripts/install-run-rush.js update --full - run: npm install rollup -g diff --git a/.npmrc b/.npmrc new file mode 100644 index 000000000..b6f27f135 --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +engine-strict=true diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 000000000..ce62013c3 --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +24.22.1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9661939cc..41de208f0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,6 +26,23 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope [GitHubIssue]: https://github.com/microsoft/ApplicationInsights-JS/issues ## Clone and setup + +Use a patched Node.js runtime before installing dependencies or running any repository tooling: +Node.js 22.23.4+, 24.22.1+, or 26.12.1+ within those respective release lines. +Node.js 24 LTS is recommended; `.nvmrc` selects 24.22.1 for local version managers. +Node.js 18, 20, and other unsupported release lines must not be used for builds or releases. +The root npm and Rush configuration enforce these build-time version requirements; they do not change browser SDK compatibility. + +These minimum versions fix [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). +Although SDK telemetry compression uses gzip, npm and HTTP clients used by repository tools can decode Brotli responses. +Updating npm dependencies or disabling telemetry compression does not patch the native decoder. +Always update Node.js itself before running `npm install`, including on release agents. + +CI selects the latest patches satisfying the security minimums instead of reusing an older cached major version. +GitHub JavaScript actions use the runner's bundled Node.js runtime independently of `actions/setup-node`. +Keep self-hosted runners and their bundled action runtimes patched, and verify managed runner updates separately. +Private release pipelines and container images maintained outside this repository must also use patched runtimes. + 1. Clone the repository and create a new branch 2. Install all dependencies ``` diff --git a/package.json b/package.json index a7410bfc1..15152394d 100644 --- a/package.json +++ b/package.json @@ -48,6 +48,9 @@ "url": "https://github.com/microsoft/ApplicationInsights-JS/issues" }, "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme", + "engines": { + "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27" + }, "devDependencies": { "@microsoft/rush": "5.178.1", "@nevware21/grunt-eslint-ts": "^0.5.2", diff --git a/rush.json b/rush.json index b7c1287c9..0ce7d4b05 100644 --- a/rush.json +++ b/rush.json @@ -2,6 +2,7 @@ "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush.schema.json", "pnpmVersion": "10.34.5", "rushVersion": "5.178.1", + "nodeSupportedVersionRange": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27", "projectFolderMaxDepth": 4, "projects": [ { From 3170f12c2f3d6196b6e46aa9b4001aa059f23661 Mon Sep 17 00:00:00 2001 From: Hector Hernandez <39923391+hectorhdzg@users.noreply.github.com> Date: Fri, 23 Oct 2026 11:36:52 -0700 Subject: [PATCH 2/2] fix: pin patched decoder dependency to its patch target Keep the Rush override and lockfile on decode-uri-component 0.5.0 so full dependency resolution cannot select a version without the required CommonJS patch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- common/config/rush/pnpm-config.json | 2 +- common/config/rush/pnpm-lock.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/common/config/rush/pnpm-config.json b/common/config/rush/pnpm-config.json index 24b9203c3..fc519507b 100644 --- a/common/config/rush/pnpm-config.json +++ b/common/config/rush/pnpm-config.json @@ -11,7 +11,7 @@ "form-data": ">=2.5.6 <3.0.0", "js-yaml": ">=4.3.1 <5.0.0", "markdown-it": ">=14.2.0", - "decode-uri-component": ">=0.5.0", + "decode-uri-component": "0.5.0", "@microsoft/api-extractor": "7.58.7", "basic-ftp": ">=6.2.1", "brace-expansion": ">=5.0.12 <6.0.0", diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml index bd02029ef..c50266506 100644 --- a/common/config/rush/pnpm-lock.yaml +++ b/common/config/rush/pnpm-lock.yaml @@ -15,7 +15,7 @@ overrides: form-data: '>=2.5.6 <3.0.0' js-yaml: '>=4.3.1 <5.0.0' markdown-it: '>=14.2.0' - decode-uri-component: '>=0.5.0' + decode-uri-component: 0.5.0 '@microsoft/api-extractor': 7.58.7 basic-ftp: '>=6.2.1' brace-expansion: '>=5.0.12 <6.0.0'