fix: require patched Node runtimes for repository builds

.github/workflows/ci.yml

@@ -29,14 +29,15 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [ 18, 20, 22, 24 ]
+        node-version: [ '>=22.23.4 <23', '>=24.22.1 <25', '>=26.12.1 <27' ]
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ matrix.node-version }}
+        check-latest: true
     - name: Update rush shrinkwrap dependencies (for different node versions)
       run: node common/scripts/install-run-rush.js update --full --recheck
     - run: npm install rollup -g

.github/workflows/codeql-analysis.yml

@@ -40,7 +40,7 @@ jobs:
           - language: actions
           - language: javascript
           - language: javascript-typescript
-            node-version: '18'
+            node-version: '>=24.22.1 <25'
         # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
         # Use `c-cpp` to analyze code written in C, C++ or both
         # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
@@ -61,6 +61,7 @@ jobs:
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ matrix.node-version }}
+        check-latest: true
 
     # Install dependencies for JavaScript projects
     - name: Install dependencies

.github/workflows/jekyll-gh-pages.yml

@@ -28,10 +28,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Use Node.js ${{ matrix.node-version }}
+      - name: Use patched Node.js LTS
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: '>=24.22.1 <25'
+          check-latest: true
       - name: Update rush shrinkwrap dependencies (for different node versions)
         run: node common/scripts/install-run-rush.js update --full
       - run: npm install rollup -g

.npmrc

@@ -0,0 +1 @@
+engine-strict=true

.nvmrc

@@ -0,0 +1 @@
+24.22.1

CONTRIBUTING.md

@@ -26,6 +26,23 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope
 [GitHubIssue]: https://github.com/microsoft/ApplicationInsights-JS/issues
 
 ## Clone and setup
+
+Use a patched Node.js runtime before installing dependencies or running any repository tooling:
+Node.js 22.23.4+, 24.22.1+, or 26.12.1+ within those respective release lines.
+Node.js 24 LTS is recommended; `.nvmrc` selects 24.22.1 for local version managers.
+Node.js 18, 20, and other unsupported release lines must not be used for builds or releases.
+The root npm and Rush configuration enforce these build-time version requirements; they do not change browser SDK compatibility.
+
+These minimum versions fix [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).
+Although SDK telemetry compression uses gzip, npm and HTTP clients used by repository tools can decode Brotli responses.
+Updating npm dependencies or disabling telemetry compression does not patch the native decoder.
+Always update Node.js itself before running `npm install`, including on release agents.
+
+CI selects the latest patches satisfying the security minimums instead of reusing an older cached major version.
+GitHub JavaScript actions use the runner's bundled Node.js runtime independently of `actions/setup-node`.
+Keep self-hosted runners and their bundled action runtimes patched, and verify managed runner updates separately.
+Private release pipelines and container images maintained outside this repository must also use patched runtimes.
+
 1. Clone the repository and create a new branch
 2. Install all dependencies
 	```

common/config/rush/pnpm-config.json

@@ -11,7 +11,7 @@
     "form-data": ">=2.5.6 <3.0.0",
     "js-yaml": ">=4.3.1 <5.0.0",
     "markdown-it": ">=14.2.0",
-    "decode-uri-component": ">=0.5.0",
+    "decode-uri-component": "0.5.0",
     "@microsoft/api-extractor": "7.58.7",
     "basic-ftp": ">=6.2.1",
     "brace-expansion": ">=5.0.12 <6.0.0",

package.json

@@ -48,6 +48,9 @@
         "url": "https://github.com/microsoft/ApplicationInsights-JS/issues"
     },
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
+    "engines": {
+        "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27"
+    },
     "devDependencies": {
         "@microsoft/rush": "5.178.1",
         "@nevware21/grunt-eslint-ts": "^0.5.2",

rush.json

@@ -2,6 +2,7 @@
   "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush.schema.json",
   "pnpmVersion": "10.34.5",
   "rushVersion": "5.178.1",
+  "nodeSupportedVersionRange": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27",
   "projectFolderMaxDepth": 4,
   "projects": [
     {