[Dima Birenbaum (DimaBir)]

Why

The customer-facing latest branch still ships the older NuGet decoder path for CVE-2026-111497. This targeted backport adopts the behavior merged in toolkit PR #24 without promoting the 81 unrelated commits on main.

What

• Reject unsupported/Brotli metadata encodings before decompression; preserve supported formats, binary transfers, authentication and caching.
• Add 27 shipped-dependency tests and read-only Windows/Linux, Node 20/24 security CI without package-feed authentication.
• In a separate CI-only commit, update the legacy scan-verification action versions and per-OS artifact names to those already used on main.

How

Base directly on latest at d0736c546281e0632667b8e0046ae3d7bba0bf67. The only production change is inside the vendored toolkit's requestJson. Native dynamic import retains ESM decompressor compatibility on Node 20.13.1. Do not import main's unrelated proxy, runtime or action-layout changes.

No package/version/lockfile changes, runtime guard, npm publication, tag creation or release-ref movement are included. Merging into latest would affect consumers of that branch and needs release review; this PR does not authorize an automatic merge.

Tests

• All 10 rejection/negotiation cases fail against untouched latest.
• All 27 focused tests pass locally on SHA-verified Node.js 20.13.1 and 24.22.1; no skips.
• Existing source/test compilation, TypeScript noEmit, shipped-JS syntax and workflow YAML checks passed using the branch's locked dev-tool versions.
• Both backports have the same rejection policy; production code outside requestJson is unchanged.

Existing baseline limitations

The legacy Mocha suite has 7 pre-existing failures (missing run/sendReport exports and invalid stub cleanup), reproduced before and after this change on Node 20.13.1. Those tests are neither modified nor skipped. This is not an all-green full-suite claim.

The new matrix and restored scan-verification workflow still need hosted CI evidence. Review the baseline failures and complete legitimate Windows/Linux scan/SARIF verification before release/incident closure.