[Jackson Weber (JacksonWeber)]

Summary

Adopt the complete October 21, 2026 Node.js security baseline, rather than a Brotli-only workaround.

• Pin the existing CI lanes to Node 22.23.4 and 24.22.1, including an explicit patched runtime for the docs version-check job.
• Check the actual Node runtime after setup so vulnerable patch releases, EOL 23/25, and prereleases cannot satisfy the baseline.
• Pin the AKS sample image to node:22.23.4-bookworm-slim and check its runtime before installing dependencies.
• Set root and sample engine requirements to ^22.23.4 || ^24.22.1 || >=26.12.1, synchronizing lockfile metadata and related documentation without changing dependency resolutions.

Why this is necessary

The security release addresses applicable DNS, TLS, HTTP, Brotli, crypto/snapshot, permission-model, and ZIP fixes, together with line-specific bundled dependency updates. Not every issue affects every Node release line.

The browser SDK injector uses Node's Brotli decoder and encoder, and Agent365 uses Node's built-in fetch. Updating the executing runtime covers these paths and the other applicable fixes. Encoding-only compression is included as precautionary hardening; this does not claim that the encoder is vulnerable.

Application source, compression behavior, and wire formats are unchanged.

Scope and checks

• Shared Action/task runtimes remain provider-owned.
• SDK installation and engines metadata do not replace customer runtimes or redeploy existing containers.
• Public validation results are available in the PR checks.

[Copilot]

🟡 Changes recommended

The published README still advertises runtimes excluded by the security baseline, leaving customer upgrade guidance inconsistent.

1 open issue

• Document the updated Node.js runtime security baseline · New

3 files not reviewed

• samples/agent365-s2s/package-lock.json: Generated file
• samples/aks-langchain/package-lock.json: Generated file
• samples/package-lock.json: Generated file

What changed in this PR

This PR adopts the October 2026 Node.js security baseline across CI, package requirements, and the AKS sample without changing application behavior or dependency resolutions.

Changes:

• Pin CI and container runtimes to patched releases and verify the executing Node.js version.
• Align root and sample engine requirements with lockfile metadata.
• Add runtime-guard tests and document the baseline in the changelog.

File	Description
test/​integration/​node-version.test.mjs	Tests version boundaries, runtime checks, and metadata alignment.
scripts/​check-node-version.cjs	Adds the executing-runtime security baseline guard.
samples/​package.json	Updates sample runtime requirements.
samples/​package-lock.json	Aligns sample and linked root engine metadata.
samples/​fabric/​package.json	Adds the required runtime range.
samples/​aks-langchain/​package.json	Updates AKS sample runtime requirements.
samples/​aks-langchain/​package-lock.json	Aligns AKS sample engine metadata.
samples/​aks-langchain/​Dockerfile	Pins and verifies the patched Node.js image.
samples/​agent365-s2s/​package.json	Updates Agent365 sample runtime requirements.
samples/​agent365-s2s/​package-lock.json	Aligns sample and linked root engine metadata.
package.json	Sets the package’s supported runtime range.
package-lock.json	Aligns root engine metadata.
CHANGELOG.md	Records the new security baseline.
.github/​workflows/​pr-validation.yml	Pins runtimes and runs baseline checks and tests.
.github/​workflows/​performance.yml	Pins and checks the performance-job runtime.
.github/​workflows/​docs.yml	Pins and checks both documentation-job runtimes.

_{Review effort: Balanced}