[Dima Birenbaum (DimaBir)]

Why

CVE-2026-111497 affects the native Brotli decoder in Node.js, which the CLI installer can reach through decompress-response. Updating JavaScript dependencies or actions/setup-node alone does not patch the runner-managed action interpreter.

What

• Enforce stable upstream patch floors of Node.js 22.23.4, 24.22.1, and 26.12.1.
• Log the actual action executable, Node.js version, and Brotli version.
• Include the shipped JavaScript, 26 regression cases, and runner remediation/verification documentation.

How

Validate the runtime at the start of MicrosoftSecurityDevOps.runMain, before toolkit execution or CLI installation. Unpatched, end-of-life, prerelease, and unrecognized runtimes fail with actionable runner guidance. Accepted runtimes preserve existing CLI arguments and behavior. No dependency, workflow, or unrelated compiler-helper changes are included.

This is fail-closed protection, not a runner runtime rollout or proof that deployed runners are patched. Vendor backports with older version numbers require a reviewed policy update.

Tests

• gulp buildTests: passed; production code and tests compile.
• mocha "**/*.tests.js": 32 passed, including all 6 existing tests.
• tsc --project tsconfig.json --noEmit: passed.
• node lib\v1\main.js: the shipped entrypoint rejects unverified Node.js 25.9.0 with exit code 1 before CLI installation.
• Staged diff checks: passed; 6 files, 150 insertions, no new code comments.

Private GitHub Packages authentication blocked normal npm ci; local validation used an isolated install of repository-locked direct dev-tool versions.