[kvz]

The Node 24 selector and NodeSource bootstrap could reuse a runtime older than the October security fixes, including the native Brotli memory corruption fix.

Use ^24.22.1 with check-latest: true for CI signature parity tooling. The development image now copies Node/npm from the published node:24.22.1-bookworm-slim image instead of running a floating NodeSource installer. The Java 8/11 support matrix and Java SDK behavior stay intact.

Validation: the complete development image built with --pull on amd64 and reported Node 24.22.1, npm 11.19.1, and JDK 17. In that image, ./gradlew --no-daemon assemble and ./gradlew --no-daemon check passed: 86 tests passed, including Node signature parity; three existing credential-gated integration tests were skipped. YAML parsing, git diff --check, and council review passed. CI passed on Java 8 and 11 with Node 24.22.1; native arm64 image execution has not been repeated locally.

_{🤖 Claimed by kvz on framework1/java-sdk since 2026-10-21 · resume: codex resume 01a15e32-a05f-7153-89c2-0b1273795a49}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.04%. Comparing base (e0f3219) to head (cb33ecf).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #103   +/-   ##
=========================================
  Coverage     77.04%   77.04%           
  Complexity      217      217           
=========================================
  Files            13       13           
  Lines           793      793           
  Branches         71       71           
=========================================
  Hits            611      611           
  Misses          146      146           
  Partials         36       36           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.