From 4a8067dc5cdaa584b213e3f2ca861aa0f301777f Mon Sep 17 00:00:00 2001
From: Jackson Weber <jacksonweber@microsoft.com>
Date: Fri, 23 Oct 2026 11:47:13 -0700
Subject: [PATCH 1/2] Require October 2026 Node security baselines

Pin supported runtimes to the full October 21 security release, including precautionary compression encoding coverage. Document external runtime verification and the unmodified legacy release scope.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/integration.yml         |  2 +-
 .github/workflows/node.js-linux-arm64.yml |  2 +-
 .github/workflows/node.js-windows.yml     |  2 +-
 .github/workflows/node.js.yml             |  2 +-
 .github/workflows/npm-publish.yml         |  4 ++--
 .github/workflows/performance-comment.yml |  2 +-
 .github/workflows/performance.yml         |  2 +-
 .nvmrc                                    |  1 +
 CONTRIBUTING.md                           | 11 ++++++++--
 README.md                                 | 25 ++++++++++++++++++++++-
 package-lock.json                         |  2 +-
 package.json                              |  2 +-
 test/functionalTests/runner/package.json  |  3 +++
 test/functionalTests/testApp/package.json |  3 +++
 test/performanceTests/README.md           |  4 ++++
 test/performanceTests/package-lock.json   |  3 +++
 test/performanceTests/package.json        |  3 +++
 17 files changed, 60 insertions(+), 13 deletions(-)
 create mode 100644 .nvmrc

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index c90e0af9a..849d6689f 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -13,7 +13,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [22.x]
+        node-version: ['22.23.4']
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/node.js-linux-arm64.yml b/.github/workflows/node.js-linux-arm64.yml
index 50103cc03..fa3019a20 100644
--- a/.github/workflows/node.js-linux-arm64.yml
+++ b/.github/workflows/node.js-linux-arm64.yml
@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [22.x, 24.x]
+        node-version: ['22.23.4', '24.22.1', '26.12.1']
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/node.js-windows.yml b/.github/workflows/node.js-windows.yml
index facc6b538..80c3b1b39 100644
--- a/.github/workflows/node.js-windows.yml
+++ b/.github/workflows/node.js-windows.yml
@@ -13,7 +13,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [22.x, 24.x]
+        node-version: ['22.23.4', '24.22.1', '26.12.1']
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index 011adcd62..ebd8d4a7f 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -14,7 +14,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        node-version: [22.x, 24.x]
+        node-version: ['22.23.4', '24.22.1', '26.12.1']
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index c24fe3c81..c2a78d0e0 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version: '22.23.4'
       - run: npm ci
       - run: npm test
 
@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version: '22.23.4'
           registry-url: https://registry.npmjs.org/
       - run: npm i
       - run: npm publish
diff --git a/.github/workflows/performance-comment.yml b/.github/workflows/performance-comment.yml
index 6503acfe8..a00f9d9be 100644
--- a/.github/workflows/performance-comment.yml
+++ b/.github/workflows/performance-comment.yml
@@ -43,7 +43,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '22.x'
+          node-version: '22.23.4'
 
       - name: Download perf-results artifact
         id: download
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index 4b34b3522..e9a794512 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -20,7 +20,7 @@ jobs:
     # scenarios * (warmup + samples * duration + per-child init).
     timeout-minutes: 40
     env:
-      NODE_VERSION: '22.x'
+      NODE_VERSION: '22.23.4'
       PERF_SAMPLES: '3'
       PERF_DURATION: '5'
       PERF_WARMUP: '1'
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 000000000..ce62013c3
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 547c41124..16a45af46 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -17,7 +17,10 @@ contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additio
 1. Fork this repo
 2. Clone your fork locally `git clone https://github.com/<youruser>/ApplicationInsights-node.js`.
 3. Open a terminal and move into your local copy `cd ApplicationInsights-node.js`.
-4. Install all dependencies with `npm install`.
+4. Use Node.js 24.22.1 (the repository `.nvmrc` default), or another patched release listed in
+   [Supported Node.js versions](README.md#supported-nodejs-versions). Verify `node --version`, then install dependencies
+   with `npm ci --engine-strict`. Use the same patched runtime for builds, tests, performance tooling, and compression
+   encoding as well as decoding. Do not rely on the SDK installation to upgrade your runtime.
 5. Build project 
     ```bash
     npm run build
@@ -32,7 +35,11 @@ contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additio
     ```
     _Note: Functional tests require Docker_
     
-8. Run back compatibility tests to ckeck older version of Node.js runtime and Typescript.
+8. The back compatibility workflow targets the separate `2.x` branch. Its older Node.js runtime matrix is not part of
+   the main branch security baseline and requires a separate legacy support/backport decision. Do not switch to an
+   end-of-life runtime to run main branch tests. Historical TypeScript/type-definition fixtures do not establish
+   support for unpatched Node.js versions.
+   The legacy test command is:
     ```bash
     npm run backcompattest
     ```
diff --git a/README.md b/README.md
index 413d13759..116403210 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,30 @@ Azure VMs and Web Apps, and even other public clouds. This solution is based on
 > *Important:* The Azure Monitor OpenTelemetry-based Offerings for Node.js applications do not support older versions of Node that were supported by
 Application Insights 2.X SDK. If you rely on this support, please continue to use version 2.X.
 
-We support the versions of Node.js that are [supported by OpenTelemetry](https://github.com/open-telemetry/opentelemetry-js#supported-runtimes).
+Use a maintained Node.js release supported by [OpenTelemetry](https://github.com/open-telemetry/opentelemetry-js#supported-runtimes)
+and the Azure Monitor dependencies, with at least the following security patch:
+
+| Node.js release line | Minimum version |
+| --- | --- |
+| 22.x | 22.23.4 |
+| 24.x | 24.22.1 |
+| 26.x | 26.12.1 |
+
+These minimums include the full [October 21, 2026 Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases):
+the applicable DNS, TLS, HTTP keep-alive, Brotli decoder, crypto snapshot, permission model, and Node.js 26 ZIP fixes,
+plus the bundled c-ares, certificate trust, OpenSSL, SQLite, and Undici updates for each release line.
+Use newer security patches within these lines as they become available. End-of-life releases, including Node.js 23 and 25,
+are not a secure alternative. Future major versions require a support review.
+
+Upgrade the **Node.js runtime**, not just this npm package. The `engines` requirement is advisory unless your package manager
+enforces it; installing the SDK does not replace Node.js or prove that a deployed process is patched.
+Verify the actual `process.version` in every application, container, Azure Functions/App Service instance, and build task
+(including tasks with their own embedded Node.js). Repository CI pins do not update these external runtimes.
+
+The same runtime baseline applies to compression encoding and decoding, including the browser SDK loader and test tooling.
+Encoding-only usage is included as precautionary hardening, not because the Brotli encoder is identified as vulnerable.
+Compression algorithms and formats are unchanged. Using the 2.X SDK for compatibility does not patch an older Node.js runtime;
+legacy deployments still need a patched, supported runtime and separate compatibility validation.
 
 ## Limitations of Application Insights 3.X SDK
 
diff --git a/package-lock.json b/package-lock.json
index 885f16028..c7df6e0e3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -49,7 +49,7 @@
         "typescript": "~5.4.0"
       },
       "engines": {
-        "node": ">=22.0.0"
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "node_modules/@azure-rest/core-client": {
diff --git a/package.json b/package.json
index 65da79a8a..4022419bb 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "backcompattest": "npm run build && npm pack && node --use_strict ./test/backCompatibility/runBackCompatTests.js"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "devDependencies": {
     "@types/long": "^4.0.2",
diff --git a/test/functionalTests/runner/package.json b/test/functionalTests/runner/package.json
index d289bd998..e90267b51 100644
--- a/test/functionalTests/runner/package.json
+++ b/test/functionalTests/runner/package.json
@@ -3,6 +3,9 @@
   "version": "1.0.0",
   "description": "",
   "private": true,
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
+  },
   "main": "Main.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
diff --git a/test/functionalTests/testApp/package.json b/test/functionalTests/testApp/package.json
index 6fedc37e2..4ca9866da 100644
--- a/test/functionalTests/testApp/package.json
+++ b/test/functionalTests/testApp/package.json
@@ -2,6 +2,9 @@
   "name": "ainodejs-functionaltests-testapp",
   "version": "1.0.0",
   "description": "",
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
+  },
   "main": "Main.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
diff --git a/test/performanceTests/README.md b/test/performanceTests/README.md
index 76a314e8e..1d422420c 100644
--- a/test/performanceTests/README.md
+++ b/test/performanceTests/README.md
@@ -3,6 +3,10 @@
 The performance test harness measures throughput (ops/s) for hot-path APIs in
 this package and reports them against an upstream-OpenTelemetry-only baseline.
 
+Use a patched runtime from [Supported Node.js versions](../../README.md#supported-nodejs-versions).
+CI runs both the candidate and baseline on Node.js 22.23.4; use that same version for comparable local results.
+Install this harness with `npm ci --engine-strict`. The repository development default is Node.js 24.22.1.
+
 #### Manual run
 
 1. Copy `sample.env` to `.env` and set `APPLICATIONINSIGHTS_CONNECTION_STRING`
diff --git a/test/performanceTests/package-lock.json b/test/performanceTests/package-lock.json
index 878a5283a..dfb9335d1 100644
--- a/test/performanceTests/package-lock.json
+++ b/test/performanceTests/package-lock.json
@@ -23,6 +23,9 @@
         "eslint": "^8.0.0",
         "rimraf": "^5.0.5",
         "typescript": "~5.3.3"
+      },
+      "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "node_modules/@azure-rest/core-client": {
diff --git a/test/performanceTests/package.json b/test/performanceTests/package.json
index 4101ca358..343a5a7f8 100644
--- a/test/performanceTests/package.json
+++ b/test/performanceTests/package.json
@@ -25,6 +25,9 @@
     "typescript": "~5.3.3"
   },
   "private": true,
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
+  },
   "scripts": {
     "perf-test:node": "npm run build && node dist-esm/index.spec.js",
     "perf:benchmark": "npm run build && node runBenchmarks.mjs",

From 4ee6fce4f68026336c203167ac0eb4c195e230ed Mon Sep 17 00:00:00 2001
From: Jackson Weber <jacksonweber@microsoft.com>
Date: Fri, 23 Oct 2026 17:07:36 -0700
Subject: [PATCH 2/2] Preserve CI check names and focus runtime security patch

Separate stable matrix labels from pinned Node versions and replace optional documentation and development defaults with a short changelog entry.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/integration.yml         |  8 +++++---
 .github/workflows/node.js-linux-arm64.yml | 10 ++++++---
 .github/workflows/node.js-windows.yml     | 10 ++++++---
 .github/workflows/node.js.yml             | 10 ++++++---
 .nvmrc                                    |  1 -
 CHANGELOG.md                              |  2 ++
 CONTRIBUTING.md                           | 11 ++--------
 README.md                                 | 25 +----------------------
 test/performanceTests/README.md           |  4 ----
 9 files changed, 31 insertions(+), 50 deletions(-)
 delete mode 100644 .nvmrc

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 849d6689f..bb8e51f57 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -8,19 +8,21 @@ on:
 
 jobs:
   integration:
+    name: integration (${{ matrix.node-version.label }})
 
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        node-version: ['22.23.4']
+        node-version:
+          - { label: '22.x', version: '22.23.4' }
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - run: openssl req -x509 -nodes -newkey rsa -keyout ./test/certs/server-key.pem -out ./test/certs/server-cert.pem -days 1 -subj "/C=CL/ST=RM/L=OpenTelemetryTest/O=Root/OU=Test/CN=ca"
-    - name: Use Node.js ${{ matrix.node-version }}
+    - name: Use Node.js ${{ matrix.node-version.version }}
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: ${{ matrix.node-version.version }}
     - run: npm i
     - run: npm run functionaltest
diff --git a/.github/workflows/node.js-linux-arm64.yml b/.github/workflows/node.js-linux-arm64.yml
index fa3019a20..48d9fefea 100644
--- a/.github/workflows/node.js-linux-arm64.yml
+++ b/.github/workflows/node.js-linux-arm64.yml
@@ -8,11 +8,15 @@ on:
 
 jobs:
   build:
+    name: build (${{ matrix.node-version.label }})
     runs-on: ubuntu-24.04-arm
 
     strategy:
       matrix:
-        node-version: ['22.23.4', '24.22.1', '26.12.1']
+        node-version:
+          - { label: '22.x', version: '22.23.4' }
+          - { label: '24.x', version: '24.22.1' }
+          - { label: '26.x', version: '26.12.1' }
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -22,10 +26,10 @@ jobs:
           mkdir -p ./test/certs
           openssl req -x509 -nodes -newkey rsa:2048 -keyout ./test/certs/server-key.pem -out ./test/certs/server-cert.pem -days 1 -subj "/C=CL/ST=RM/L=OpenTelemetryTest/O=Root/OU=Test/CN=ca"
 
-      - name: Use Node.js ${{ matrix.node-version }}
+      - name: Use Node.js ${{ matrix.node-version.version }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: ${{ matrix.node-version.version }}
 
       - run: npm run clean
       - run: npm i
diff --git a/.github/workflows/node.js-windows.yml b/.github/workflows/node.js-windows.yml
index 80c3b1b39..ccf44330a 100644
--- a/.github/workflows/node.js-windows.yml
+++ b/.github/workflows/node.js-windows.yml
@@ -8,12 +8,16 @@ on:
 
 jobs:
   build:
+    name: build (${{ matrix.node-version.label }})
 
     runs-on: windows-latest
 
     strategy:
       matrix:
-        node-version: ['22.23.4', '24.22.1', '26.12.1']
+        node-version:
+          - { label: '22.x', version: '22.23.4' }
+          - { label: '24.x', version: '24.22.1' }
+          - { label: '26.x', version: '26.12.1' }
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -38,10 +42,10 @@ jobs:
         $randomKeyContent = [Convert]::ToBase64String($randomBytes)
         Set-Content -Path "$certsDir\server-key.pem" -Value "-----BEGIN PRIVATE KEY-----`r`n$randomKeyContent`r`n-----END PRIVATE KEY-----"
 
-    - name: Use Node.js ${{ matrix.node-version }}
+    - name: Use Node.js ${{ matrix.node-version.version }}
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: ${{ matrix.node-version.version }}
 
     - run: npm run clean
     - name: Install dependencies
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index ebd8d4a7f..5ab500bce 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -8,21 +8,25 @@ on:
 
 jobs:
   build:
+    name: build (${{ matrix.os }}, ${{ matrix.node-version.label }})
 
     runs-on: ${{ matrix.os }}
 
     strategy:
       matrix:
         os: [ubuntu-latest]
-        node-version: ['22.23.4', '24.22.1', '26.12.1']
+        node-version:
+          - { label: '22.x', version: '22.23.4' }
+          - { label: '24.x', version: '24.22.1' }
+          - { label: '26.x', version: '26.12.1' }
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - run: openssl req -x509 -nodes -newkey rsa -keyout ./test/certs/server-key.pem -out ./test/certs/server-cert.pem -days 1 -subj "/C=CL/ST=RM/L=OpenTelemetryTest/O=Root/OU=Test/CN=ca"
-    - name: (${{ matrix.os }}) on Node.js ${{ matrix.node-version }}
+    - name: (${{ matrix.os }}) on Node.js ${{ matrix.node-version.version }}
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: ${{ matrix.node-version.version }}
     - run: npm run clean
     - run: npm i
     - run: npm run build --if-present
diff --git a/.nvmrc b/.nvmrc
deleted file mode 100644
index ce62013c3..000000000
--- a/.nvmrc
+++ /dev/null
@@ -1 +0,0 @@
-24.22.1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d5bda4f9..a5957a0cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Require Node.js 22.23.4+, 24.22.1+, or 26.12.1+ within those release lines and update CI for the full October 21, 2026 security release, including precautionary compression-encoding coverage. Upgrade deployed runtimes separately; installing the SDK does not update Node.js.
+
 ### 3.17.0 (2026-10-06)
 
 #### Breaking Changes
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 16a45af46..547c41124 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -17,10 +17,7 @@ contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additio
 1. Fork this repo
 2. Clone your fork locally `git clone https://github.com/<youruser>/ApplicationInsights-node.js`.
 3. Open a terminal and move into your local copy `cd ApplicationInsights-node.js`.
-4. Use Node.js 24.22.1 (the repository `.nvmrc` default), or another patched release listed in
-   [Supported Node.js versions](README.md#supported-nodejs-versions). Verify `node --version`, then install dependencies
-   with `npm ci --engine-strict`. Use the same patched runtime for builds, tests, performance tooling, and compression
-   encoding as well as decoding. Do not rely on the SDK installation to upgrade your runtime.
+4. Install all dependencies with `npm install`.
 5. Build project 
     ```bash
     npm run build
@@ -35,11 +32,7 @@ contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additio
     ```
     _Note: Functional tests require Docker_
     
-8. The back compatibility workflow targets the separate `2.x` branch. Its older Node.js runtime matrix is not part of
-   the main branch security baseline and requires a separate legacy support/backport decision. Do not switch to an
-   end-of-life runtime to run main branch tests. Historical TypeScript/type-definition fixtures do not establish
-   support for unpatched Node.js versions.
-   The legacy test command is:
+8. Run back compatibility tests to ckeck older version of Node.js runtime and Typescript.
     ```bash
     npm run backcompattest
     ```
diff --git a/README.md b/README.md
index 116403210..413d13759 100644
--- a/README.md
+++ b/README.md
@@ -17,30 +17,7 @@ Azure VMs and Web Apps, and even other public clouds. This solution is based on
 > *Important:* The Azure Monitor OpenTelemetry-based Offerings for Node.js applications do not support older versions of Node that were supported by
 Application Insights 2.X SDK. If you rely on this support, please continue to use version 2.X.
 
-Use a maintained Node.js release supported by [OpenTelemetry](https://github.com/open-telemetry/opentelemetry-js#supported-runtimes)
-and the Azure Monitor dependencies, with at least the following security patch:
-
-| Node.js release line | Minimum version |
-| --- | --- |
-| 22.x | 22.23.4 |
-| 24.x | 24.22.1 |
-| 26.x | 26.12.1 |
-
-These minimums include the full [October 21, 2026 Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases):
-the applicable DNS, TLS, HTTP keep-alive, Brotli decoder, crypto snapshot, permission model, and Node.js 26 ZIP fixes,
-plus the bundled c-ares, certificate trust, OpenSSL, SQLite, and Undici updates for each release line.
-Use newer security patches within these lines as they become available. End-of-life releases, including Node.js 23 and 25,
-are not a secure alternative. Future major versions require a support review.
-
-Upgrade the **Node.js runtime**, not just this npm package. The `engines` requirement is advisory unless your package manager
-enforces it; installing the SDK does not replace Node.js or prove that a deployed process is patched.
-Verify the actual `process.version` in every application, container, Azure Functions/App Service instance, and build task
-(including tasks with their own embedded Node.js). Repository CI pins do not update these external runtimes.
-
-The same runtime baseline applies to compression encoding and decoding, including the browser SDK loader and test tooling.
-Encoding-only usage is included as precautionary hardening, not because the Brotli encoder is identified as vulnerable.
-Compression algorithms and formats are unchanged. Using the 2.X SDK for compatibility does not patch an older Node.js runtime;
-legacy deployments still need a patched, supported runtime and separate compatibility validation.
+We support the versions of Node.js that are [supported by OpenTelemetry](https://github.com/open-telemetry/opentelemetry-js#supported-runtimes).
 
 ## Limitations of Application Insights 3.X SDK
 
diff --git a/test/performanceTests/README.md b/test/performanceTests/README.md
index 1d422420c..76a314e8e 100644
--- a/test/performanceTests/README.md
+++ b/test/performanceTests/README.md
@@ -3,10 +3,6 @@
 The performance test harness measures throughput (ops/s) for hot-path APIs in
 this package and reports them against an upstream-OpenTelemetry-only baseline.
 
-Use a patched runtime from [Supported Node.js versions](../../README.md#supported-nodejs-versions).
-CI runs both the candidate and baseline on Node.js 22.23.4; use that same version for comparable local results.
-Install this harness with `npm ci --engine-strict`. The repository development default is Node.js 24.22.1.
-
 #### Manual run
 
 1. Copy `sample.env` to `.env` and set `APPLICATIONINSIGHTS_CONNECTION_STRING`