[Dima Birenbaum (DimaBir)]

Why

Toolkit PR #24 mitigates the Node.js Brotli decoder path for CVE-2026-111497, but this action still executes an older checked-in toolkit copy. Merging the upstream TypeScript alone does not update those runtime bytes.

What

• Backport the NuGet response-encoding allowlist and explicit stream/decompression errors into the tracked toolkit JavaScript.
• Decline Brotli before decoding while retaining identity, gzip and deflate.
• Add 27 shipped-dependency regression cases and a read-only Windows/Linux, Node 20/24 CI matrix that requires no package-feed credentials.

How

Port the behavior merged as 433e1090696fec074f5fe066e209ece22a50102c, preserving the existing proxy resolver and both download/metadata proxy call sites. Use native dynamic import because the ESM decompressor cannot be loaded with require on older Node 20. All production code outside requestJson is unchanged.

Package versions, lockfiles, action lifecycle/runtime metadata and the separate runtime-guard PR #277 are unchanged. No npm publication or release-ref movement is included. A future toolkit reinstall/bump must retain both the mitigation and the existing proxy fix.

Tests

• All 10 rejection/negotiation cases fail against the untouched main runtime.
• All 27 focused tests pass locally on SHA-verified Node.js 20.13.1 and 24.22.1, including service-index/registration rejection, zero Brotli decoder calls, successful package extraction, auth/header/cache/error handling and six proxy scenarios.
• Existing main unit suite: 6 passed.
• Repository Gulp buildTests, source TypeScript noEmit and shipped-JS syntax checks passed using repository-locked dev tools.
• Workflow YAML/matrix, production-scope and diff checks passed.
• Hosted Windows/Linux checks run after publication; local fixture tests are not a deployed remediation or incident-closure claim.