Harden Node tooling for the October 2026 security baseline

.github/workflows/ci.yml

@@ -12,21 +12,26 @@
 jobs:
   build:
 
+    name: build (${{ matrix.node-line }})
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        node-version: [ 20.x, 22.x ]
+        include:
+          - node-line: '22.x'
+            node-version: '22.23.4'
+          - node-line: '24.x'
+            node-version: '24.22.1'
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm install
     - run: npm run lint
     - run: npm run build --verbose
       timeout-minutes: 10
     - run: npm run test --verbose
       timeout-minutes: 15

CONTRIBUTING.md

@@ -22,19 +22,36 @@ We strongly welcome and encourage contributions to this project. If making a lar
 ## Clone, Setup, Build & Test this repo
 1. Clone the repository and create a new branch
 
-2. Install all dependencies
+2. Select a patched Node.js runtime before installing dependencies or running any
+   build, test, documentation, development-server, or packaging tools.
+   Check `node --version` and use the npm bundled with the selected runtime.
+
+   The minimum supported tooling versions are **22.23.4**, **24.22.1**, and
+   **26.12.1**, including later stable releases within each of those major lines.
+   CI covers Node.js 22.23.4 and 24.22.1. Older, odd-numbered, and prerelease Node.js
+   versions are not supported for repository tooling. npm's root `devEngines`
+   constraint rejects unsupported runtimes for installs and `npm run` commands;
+   older npm versions that do not implement `devEngines`, direct tool invocations,
+   and commands inside `lib` or `rollup` still require selecting the runtime first.
+   Do not bypass the check with `--force`.
+
+   These are development-tooling requirements, not new runtime requirements for
+   consumers of the published browser library or Rollup plugin. See
+   [Node.js tooling security](SECURITY.md#nodejs-tooling-security) for scope.
+
+3. Install all dependencies
 
     ```sh
     npm install
     ```
 
-3. Build and create docs
+4. Build and create docs
 
     ```sh
     npm run build
     ```
 
-4. Run tests
+5. Run tests
 
     ```sh
     npm run test

SECURITY.md

@@ -39,3 +39,30 @@ We prefer all communications to be in English.
 Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd).
 
 <!-- END MICROSOFT SECURITY.MD BLOCK -->
+
+## Node.js tooling security
+
+Repository development, CI, builds, tests, documentation, and packaging use the
+[October 21, 2026 Node.js security baseline](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases):
+Node.js 22.23.4, 24.22.1, or 26.12.1, or a later stable release within one of those
+major lines. Node.js CI pins 22.23.4 and 24.22.1; CodeQL uses managed default
+scanning without the repository's custom query configuration.
+The root `package.json` uses `devEngines` to check the runtime used by npm tooling
+without adding an `engines` requirement to the published packages. Keep this
+constraint and the workflow pins in sync when raising the baseline.
+
+Updating Node.js addresses the applicable DNS, TLS, HTTP, crypto snapshot,
+filesystem-permission, Brotli decoder, and Node.js 26 ZIP fixes, plus bundled
+c-ares, CA certificate, OpenSSL, SQLite, and Undici updates where included in each
+release line. It also hardens encoding-only tooling as a precaution, including
+the Node.js zlib runtime used by compression dependencies and packaging tools
+such as `npm pack`. CVE-2026-111497 affects Brotli **decoding**; this does not
+classify encoding as vulnerable or change the library API or compression behavior.
+
+The published library does not select or ship a Node.js runtime. Consumers must
+update their own runtimes. GitHub-hosted runner images, JavaScript action runtimes
+embedded in checkout/setup-node/CodeQL, and externally managed build agents or
+pipeline tasks must be patched by their owners; `setup-node` selects the runtime
+for subsequent shell commands, not those embedded runtimes. The shared
+DynamicProto release pipeline is maintained in the separate 1DS repository and
+must retain its own patched runtime selection and guard.

package.json

@@ -44,6 +44,13 @@
     "url": "https://github.com/microsoft/DynamicProto-JS/issues"
   },
   "homepage": "https://github.com/microsoft/DynamicProto-JS#readme",
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^22.23.4 || ^24.22.1 || ^26.12.1",
+      "onFail": "error"
+    }
+  },
   "overrides": {
     "minimatch": "~3.1.2",
     "brace-expansion": "^1.1.18",