From 74103fad671436f4f85a51e05c0c6d35a404f2c2 Mon Sep 17 00:00:00 2001 From: Jackson Weber Date: Fri, 23 Oct 2026 11:54:10 -0700 Subject: [PATCH 1/4] Set October 2026 Node security baseline for tooling Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 7 ++++- .nvmrc | 1 + CONTRIBUTING.md | 25 +++++++++++++-- SECURITY.md | 67 ++++++++++++++++++++++++++++++++++++++++ sample/README.md | 20 ++++++++++++ 5 files changed, 117 insertions(+), 3 deletions(-) create mode 100644 .nvmrc diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 531a301f..fc04e287 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,8 @@ jobs: strategy: fail-fast: false matrix: - node-version: [22.x, 24.x] + # October 21, 2026 security floors; retain newer fixes within each major. + node-version: ['^22.23.4', '^24.22.1'] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -33,6 +34,10 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} + check-latest: true + - name: Report selected Node.js runtime + run: | + node -p "JSON.stringify({ executable: process.execPath, versions: process.versions })" - run: npm install - name: Use the runner's pre-installed Chrome for Puppeteer run: | diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 00000000..b8b23ca9 --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +22.23.4 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2673113a..0c1c6b8f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -27,11 +27,21 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope ## Clone and setup 1. Clone the repository and create a new branch -2. Install all dependencies +2. Select the patched Node.js tooling runtime before installing dependencies. + The root `.nvmrc` pins Node.js 22.23.4. With `nvm`, run from the repository root: + ``` + nvm install + nvm use + node --version + ``` + If using another version manager, select 22.23.4 explicitly. An already installed + newer patched Node.js 22 release does not need to be downgraded. CI also covers + Node.js 24.22.1 or newer within the 24.x line. +3. Install all dependencies ``` npm install ``` -3. Build and test +4. Build and test ``` npm run build npm run test @@ -50,3 +60,14 @@ The root folder contains the main package and supporting tooling. When making ch This will run the tests. If you are changing package versions or adding/removing any package dependencies, run `npm install` before building. + +Use the same patched Node.js runtime for Grunt, Rollup, browser-test launchers, +Metro/Expo, release scripts, archive creation, and compression/size tooling, +including Brotli encoding-only jobs as a precaution. A `.nvmrc` file does not +switch Node.js automatically in every shell or IDE; check `node --version` in +the environment that launches the command. + +This is a build/development requirement, not a new Node.js requirement for the +published React Native plugin. Hermes and JavaScriptCore are separate mobile +engines. See [Security](./SECURITY.md#nodejs-tooling-security-baseline) for the +release baseline and runtime deployment boundaries. diff --git a/SECURITY.md b/SECURITY.md index 869fdfe2..5ec20315 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -39,3 +39,70 @@ We prefer all communications to be in English. Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd). + +## Node.js tooling security baseline + +Use the complete [October 21, 2026 Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), +not just a Brotli-specific workaround: + +| Node.js line | Minimum patched version | Repository use | +| --- | --- | --- | +| 22.x | 22.23.4 | Local development default in `.nvmrc`; CI | +| 24.x | 24.22.1 | CI | +| 26.x | 26.12.1 | Security reference only; not selected or tested by this repository's CI | + +Newer patched releases within the selected major are allowed. CI uses +major-bounded ranges with `check-latest: true` so cached older runtimes cannot +satisfy the selection and newer fixes are retained. Local developers must +explicitly activate the runtime; see [contributor setup](./CONTRIBUTING.md#clone-and-setup). + +The full release addresses CVE-2026-105482, CVE-2026-105483, +CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, +CVE-2026-106074, CVE-2026-106071, and CVE-2026-106073 on the affected +lines identified in the advisory, plus its Node.js 26 ZIP validation fix. +It also updates bundled c-ares, CA certificates, and Undici on all three +lines, OpenSSL on 22/24, and SQLite on 22. Not every issue affects every line. + +### Tooling and mobile runtime boundary + +This baseline applies to Node.js processes used for dependency installation, +Grunt/Rollup builds, Puppeteer test launching, Expo/Metro development servers, +release/packaging scripts, archive creation, and compression/size reporting. +Include Brotli **encoding-only** jobs in patched-runtime coverage as a +precaution; this does not assert that encoding is vulnerable to the decoder +issue. The checked-in archive helper uses `archiver` with zlib, and the root +lockfile includes `gzip-size`; neither is a reason to exempt the tooling +runtime from the full update. + +The published plugin runs in React Native's mobile environment. Hermes and +JavaScriptCore are not Node.js. This baseline does not change SDK code, +framework peers, mobile engines, or the published package's runtime contract. +The legacy sample's Expo/Metro compatibility requires separate validation; +changing Node.js alone does not certify that toolchain. + +### Separate dependencies and deployment checks + +The root lockfile contains `undici-types` (TypeScript declarations), not a +standalone Undici runtime. No standalone Brotli, c-ares, OpenSSL, or SQLite +package is recorded there. Updating Node.js repairs its bundled libraries, +not independently installed copies. The sample has no committed lockfile, +so its resolved dependencies must be checked separately. Recheck separately +installed copies against applicable advisories when resolving or updating +tooling; do not add dependency overrides for Node.js-bundled fixes. + +Repository selections do not establish that every runtime has been deployed: + +- GitHub Actions' embedded Node.js interpreters (checkout/setup-node, CodeQL, + and issue automation) are supplied by the action/runner, not by the + `setup-node` selection for shell commands. +- Hosted/self-hosted runner images, task-embedded runtimes, shared external + release/nightly pipelines, and developer/IDE installations need their own + runtime verification and rollout. +- Consumer build environments and any separately deployed Node.js services + must be patched independently; upgrading this plugin does not patch them. + +Record the actual executable and `process.versions` in each Node.js job, +including packaging/encoding jobs, and verify the supported fixed line before +installing dependencies or processing artifacts. CI reports this information +after runtime setup. Do not treat this repository change as evidence of an +external deployment. diff --git a/sample/README.md b/sample/README.md index bd13aeb2..4b1f7fc1 100644 --- a/sample/README.md +++ b/sample/README.md @@ -4,9 +4,29 @@ This demo shows how to use ApplicationInsights with ReactNativeManualDevicePlugi # Start +Use the patched Node.js tooling runtime selected by the repository's root +`.nvmrc` (22.23.4), or a newer patched Node.js 22 release. Select it before +installing dependencies or starting Expo/Metro; `.nvmrc` alone does not change +the runtime. See [contributor setup](../CONTRIBUTING.md#clone-and-setup). + +From this `sample` directory, using that same Node.js environment: + +```sh npm install npm run start +``` android user press 'a' web user press 'w' + +This sample retains Expo 48, React 18, and React Native 0.71.8. Its Metro and +web tooling compatibility must be checked on the patched Node.js runtime; +do not fall back to an unpatched/EOL Node.js version to work around a tooling +failure. Updating Node.js does not update or establish a vulnerability in +the mobile Hermes/JavaScriptCore engine. + +The checked-in `App.js` selects the `/manual` import marked "for web". The +Android-specific import is commented out there; an Android Metro export of +the unchanged web configuration fails to resolve `/manual`. That existing +platform configuration is separate from the Node.js security update. From be01ed3e78f429b29ec89959d728749eb232f0ff Mon Sep 17 00:00:00 2001 From: Jackson Weber Date: Fri, 23 Oct 2026 12:41:24 -0700 Subject: [PATCH 2/4] Remove documentation changes from Node baseline PR Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CONTRIBUTING.md | 25 ++---------------- SECURITY.md | 67 ------------------------------------------------ sample/README.md | 20 --------------- 3 files changed, 2 insertions(+), 110 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0c1c6b8f..2673113a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -27,21 +27,11 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope ## Clone and setup 1. Clone the repository and create a new branch -2. Select the patched Node.js tooling runtime before installing dependencies. - The root `.nvmrc` pins Node.js 22.23.4. With `nvm`, run from the repository root: - ``` - nvm install - nvm use - node --version - ``` - If using another version manager, select 22.23.4 explicitly. An already installed - newer patched Node.js 22 release does not need to be downgraded. CI also covers - Node.js 24.22.1 or newer within the 24.x line. -3. Install all dependencies +2. Install all dependencies ``` npm install ``` -4. Build and test +3. Build and test ``` npm run build npm run test @@ -60,14 +50,3 @@ The root folder contains the main package and supporting tooling. When making ch This will run the tests. If you are changing package versions or adding/removing any package dependencies, run `npm install` before building. - -Use the same patched Node.js runtime for Grunt, Rollup, browser-test launchers, -Metro/Expo, release scripts, archive creation, and compression/size tooling, -including Brotli encoding-only jobs as a precaution. A `.nvmrc` file does not -switch Node.js automatically in every shell or IDE; check `node --version` in -the environment that launches the command. - -This is a build/development requirement, not a new Node.js requirement for the -published React Native plugin. Hermes and JavaScriptCore are separate mobile -engines. See [Security](./SECURITY.md#nodejs-tooling-security-baseline) for the -release baseline and runtime deployment boundaries. diff --git a/SECURITY.md b/SECURITY.md index 5ec20315..869fdfe2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -39,70 +39,3 @@ We prefer all communications to be in English. Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd). - -## Node.js tooling security baseline - -Use the complete [October 21, 2026 Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), -not just a Brotli-specific workaround: - -| Node.js line | Minimum patched version | Repository use | -| --- | --- | --- | -| 22.x | 22.23.4 | Local development default in `.nvmrc`; CI | -| 24.x | 24.22.1 | CI | -| 26.x | 26.12.1 | Security reference only; not selected or tested by this repository's CI | - -Newer patched releases within the selected major are allowed. CI uses -major-bounded ranges with `check-latest: true` so cached older runtimes cannot -satisfy the selection and newer fixes are retained. Local developers must -explicitly activate the runtime; see [contributor setup](./CONTRIBUTING.md#clone-and-setup). - -The full release addresses CVE-2026-105482, CVE-2026-105483, -CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, -CVE-2026-106074, CVE-2026-106071, and CVE-2026-106073 on the affected -lines identified in the advisory, plus its Node.js 26 ZIP validation fix. -It also updates bundled c-ares, CA certificates, and Undici on all three -lines, OpenSSL on 22/24, and SQLite on 22. Not every issue affects every line. - -### Tooling and mobile runtime boundary - -This baseline applies to Node.js processes used for dependency installation, -Grunt/Rollup builds, Puppeteer test launching, Expo/Metro development servers, -release/packaging scripts, archive creation, and compression/size reporting. -Include Brotli **encoding-only** jobs in patched-runtime coverage as a -precaution; this does not assert that encoding is vulnerable to the decoder -issue. The checked-in archive helper uses `archiver` with zlib, and the root -lockfile includes `gzip-size`; neither is a reason to exempt the tooling -runtime from the full update. - -The published plugin runs in React Native's mobile environment. Hermes and -JavaScriptCore are not Node.js. This baseline does not change SDK code, -framework peers, mobile engines, or the published package's runtime contract. -The legacy sample's Expo/Metro compatibility requires separate validation; -changing Node.js alone does not certify that toolchain. - -### Separate dependencies and deployment checks - -The root lockfile contains `undici-types` (TypeScript declarations), not a -standalone Undici runtime. No standalone Brotli, c-ares, OpenSSL, or SQLite -package is recorded there. Updating Node.js repairs its bundled libraries, -not independently installed copies. The sample has no committed lockfile, -so its resolved dependencies must be checked separately. Recheck separately -installed copies against applicable advisories when resolving or updating -tooling; do not add dependency overrides for Node.js-bundled fixes. - -Repository selections do not establish that every runtime has been deployed: - -- GitHub Actions' embedded Node.js interpreters (checkout/setup-node, CodeQL, - and issue automation) are supplied by the action/runner, not by the - `setup-node` selection for shell commands. -- Hosted/self-hosted runner images, task-embedded runtimes, shared external - release/nightly pipelines, and developer/IDE installations need their own - runtime verification and rollout. -- Consumer build environments and any separately deployed Node.js services - must be patched independently; upgrading this plugin does not patch them. - -Record the actual executable and `process.versions` in each Node.js job, -including packaging/encoding jobs, and verify the supported fixed line before -installing dependencies or processing artifacts. CI reports this information -after runtime setup. Do not treat this repository change as evidence of an -external deployment. diff --git a/sample/README.md b/sample/README.md index 4b1f7fc1..bd13aeb2 100644 --- a/sample/README.md +++ b/sample/README.md @@ -4,29 +4,9 @@ This demo shows how to use ApplicationInsights with ReactNativeManualDevicePlugi # Start -Use the patched Node.js tooling runtime selected by the repository's root -`.nvmrc` (22.23.4), or a newer patched Node.js 22 release. Select it before -installing dependencies or starting Expo/Metro; `.nvmrc` alone does not change -the runtime. See [contributor setup](../CONTRIBUTING.md#clone-and-setup). - -From this `sample` directory, using that same Node.js environment: - -```sh npm install npm run start -``` android user press 'a' web user press 'w' - -This sample retains Expo 48, React 18, and React Native 0.71.8. Its Metro and -web tooling compatibility must be checked on the patched Node.js runtime; -do not fall back to an unpatched/EOL Node.js version to work around a tooling -failure. Updating Node.js does not update or establish a vulnerability in -the mobile Hermes/JavaScriptCore engine. - -The checked-in `App.js` selects the `/manual` import marked "for web". The -Android-specific import is commented out there; an Android Metro export of -the unchanged web configuration fails to resolve `/manual`. That existing -platform configuration is separate from the Node.js security update. From 944ccca798b430fb05f94b6a0842168d06666779 Mon Sep 17 00:00:00 2001 From: Jackson Weber Date: Fri, 23 Oct 2026 12:47:33 -0700 Subject: [PATCH 3/4] Remove new nvmrc from Node security baseline PR Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .nvmrc | 1 - 1 file changed, 1 deletion(-) delete mode 100644 .nvmrc diff --git a/.nvmrc b/.nvmrc deleted file mode 100644 index b8b23ca9..00000000 --- a/.nvmrc +++ /dev/null @@ -1 +0,0 @@ -22.23.4 From ae7b08a0f141806292a822959bb4ccb6ef455c40 Mon Sep 17 00:00:00 2001 From: Jackson Weber Date: Fri, 23 Oct 2026 13:29:46 -0700 Subject: [PATCH 4/4] Preserve required Node CI check names with patched runtimes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fc04e287..6a9f786f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,7 @@ on: jobs: build: + name: build (${{ matrix.node-line }}) runs-on: ubuntu-latest @@ -26,7 +27,11 @@ jobs: fail-fast: false matrix: # October 21, 2026 security floors; retain newer fixes within each major. - node-version: ['^22.23.4', '^24.22.1'] + include: + - node-line: 22.x + node-version: '^22.23.4' + - node-line: 24.x + node-version: '^24.22.1' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1