microsoft/security-devops-action v1.12.1

v1.12.1 - Brotli response-path mitigation

on GitHub

Security mitigation

This patch mitigates the NuGet metadata response-decoding path for CVE-2026-111497.

• Decline Brotli responses and reject unsupported content encodings before decompression.
• Preserve identity, gzip and deflate handling, package downloads, authentication and cache behavior.
• Propagate response/decompression failures explicitly.
• Include a Windows/Linux response-security matrix and compatible scan-verification uploads.

The mitigation is backported to the existing release lineage through PR #278, following toolkit PR #24. PR #279 adopts it separately on main. This release does not promote unrelated main changes.

Upgrade

- uses: microsoft/security-devops-action@v1.12.1

For immutable SHA pinning, use:

- uses: microsoft/security-devops-action@cf28f87c67770dbaa208cce3665fafc849f77507

New runs resolving @latest already receive this hotfix. Existing workflows pinned to v1.12.0 or older commits must update their reference. No existing version tag is moved.

Validation and scope

• The exact release commit passed the 27-test response-security suite on Windows/Linux with Node.js 20.13.1 and 24.22.1.
• Post-merge Windows/Linux scans and SARIF uploads succeeded and produced non-empty per-OS artifacts.
• Seven pre-existing legacy unit-test failures remain; this is not an all-green legacy-suite claim.
• Dependency versions and the dependency lockfile are unchanged from v1.12.0. Existing adm-zip high-severity and uuid moderate audit advisories remain outside this targeted patch.

This mitigates the action's reported Brotli response path. It does not patch Node.js itself or establish that other Brotli consumers are remediated. No new toolkit npm package is published by this action release.