[Jackson Weber (JacksonWeber)]

Require Node.js 22.23.4 / 24.22.1 / 26.12.1 for the full October 21 security release. Update SDK/test engine floors and CI runtime pins while preserving existing check names.

Includes encoding-only compression paths as precautionary hardening; no compression-format changes or dependency overrides.

Current releases only: 2.x is not backported and retains legacy runtime risk. Deployed applications and embedded build-task runtimes must be upgraded separately.

[Copilot]

🟢 Approval recommended

The engine ranges, lockfile metadata, and CI pins are consistent, with no unresolved blocking findings.

No open issues 🎉

1 file not reviewed

• test/performanceTests/package-lock.json: Generated file

What changed in this PR

Updates the SDK’s declared Node.js requirements and CI runtimes to the October 2026 security baseline, while preserving existing check names.

Changes:

• Sets SDK and test engine floors to Node.js 22.23.4, 24.22.1, or 26.12.1 within those major release lines.
• Pins CI runtimes and adds Node.js 26 to cross-platform build matrices.
• Documents the runtime requirements and the need to upgrade deployed runtimes separately.

File	Description
test/​performanceTests/​package.json	Adds performance-test engine requirements.
test/​performanceTests/​package-lock.json	Synchronizes performance-test engine metadata.
test/​functionalTests/​testApp/​package.json	Adds functional test-app engine requirements.
test/​functionalTests/​runner/​package.json	Adds functional runner engine requirements.
package.json	Raises supported Node.js engine floors.
package-lock.json	Synchronizes SDK engine metadata.
CHANGELOG.md	Documents requirements and deployment guidance.
.github/​workflows/​performance.yml	Pins benchmarks to Node.js 22.23.4.
.github/​workflows/​performance-comment.yml	Pins performance reporting to Node.js 22.23.4.
.github/​workflows/​npm-publish.yml	Pins validation and publishing runtimes.
.github/​workflows/​node.js.yml	Pins Linux builds and adds Node.js 26 coverage.
.github/​workflows/​node.js-windows.yml	Pins Windows builds and adds Node.js 26 coverage.
.github/​workflows/​node.js-linux-arm64.yml	Pins ARM64 builds and adds Node.js 26 coverage.
.github/​workflows/​integration.yml	Pins integration tests while preserving the check name.

_{Review effort: Balanced}