From 13870ab265ae34c1bf0ae7f94013c16589003af8 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 00:09:09 +0000
Subject: [PATCH 01/11] ci: run Linux CI on CodeBuild-hosted runners

---
 .github/workflows/ci.yml                  | 2 +-
 .github/workflows/ci_static-analysis.yaml | 1 +
 .github/workflows/prod-release.yml        | 3 ++-
 .github/workflows/repo-sync.yml           | 1 +
 .github/workflows/shared-ci.yml           | 2 +-
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8b51542b8..b35e59b65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     if: always()
     needs:
       - shared-ci
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Verify all required jobs passed
         uses: re-actors/alls-green@release/v1
diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index eb05c10b5..6fe1190b8 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -8,6 +8,7 @@ permissions:
 
 jobs:
   not-grep:
+    # not-grep is a Docker container action.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 88d4d9ce1..4c6715015 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -24,7 +24,7 @@ jobs:
 
   # Once all tests have passed, run semantic versioning
   version:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     needs: [pre-release-ci]
     environment: release
     steps:
@@ -91,6 +91,7 @@ jobs:
           git log -n 1
 
   publish:
+    # npm provenance requires a GitHub-hosted runner.
     runs-on: ubuntu-latest
     needs: [pre-release-ci, version]
     environment: release
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index a55d58b84..4bf047713 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,6 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
+    # repo-sync actions are Docker container actions.
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml
index aa43e1825..2f1907b83 100644
--- a/.github/workflows/shared-ci.yml
+++ b/.github/workflows/shared-ci.yml
@@ -20,7 +20,7 @@ env:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       id-token: write
       contents: read

From 7ce0b788ecf4184d0208b1241f99a996adec4617 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 16:25:40 +0000
Subject: [PATCH 02/11] ci: keep release, benchmark, and maintenance workflows
 on GitHub-hosted runners

---
 .github/workflows/prod-release.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 4c6715015..88d4d9ce1 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -24,7 +24,7 @@ jobs:
 
   # Once all tests have passed, run semantic versioning
   version:
-    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     needs: [pre-release-ci]
     environment: release
     steps:
@@ -91,7 +91,6 @@ jobs:
           git log -n 1
 
   publish:
-    # npm provenance requires a GitHub-hosted runner.
     runs-on: ubuntu-latest
     needs: [pre-release-ci, version]
     environment: release

From f9fa58efc72f1b64aaf3dd55f7dfc72f89e66ac6 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 8 Oct 2026 18:43:07 +0000
Subject: [PATCH 03/11] ci: run the Docker-based CI jobs on CodeBuild-hosted
 runners

---
 .github/workflows/ci_static-analysis.yaml | 3 +--
 .github/workflows/repo-sync.yml           | 1 -
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index 6fe1190b8..937ab0cf6 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -8,8 +8,7 @@ permissions:
 
 jobs:
   not-grep:
-    # not-grep is a Docker container action.
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v2
       - name: not-grep
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index 4bf047713..a55d58b84 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,7 +11,6 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    # repo-sync actions are Docker container actions.
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2

From bb257af8e21dcf97803ca8aa9534b311d84d4ba4 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 20:22:53 +0000
Subject: [PATCH 04/11] ci: move the remaining Linux jobs to CodeBuild

---
 .github/workflows/prod-release.yml | 2 +-
 .github/workflows/repo-sync.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 88d4d9ce1..894ce7b42 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -24,7 +24,7 @@ jobs:
 
   # Once all tests have passed, run semantic versioning
   version:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     needs: [pre-release-ci]
     environment: release
     steps:
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index a55d58b84..f7c1fff80 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,7 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-javascript-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
     - uses: actions/checkout@v2
     - uses: repo-sync/github-sync@v2

From d14dbda536f3e087292a93842827df21b7e50d58 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 21:56:09 +0000
Subject: [PATCH 05/11] ci: drop the npm ci flag npm 12 rejects

---
 .github/workflows/prod-release.yml | 2 +-
 .github/workflows/shared-ci.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 894ce7b42..5e119166e 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -48,7 +48,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci --unsafe-perm
+        run: npm ci
 
       - name: Configure AWS Credentials for Release
         uses: aws-actions/configure-aws-credentials@v5
diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml
index 2f1907b83..647f5dc3a 100644
--- a/.github/workflows/shared-ci.yml
+++ b/.github/workflows/shared-ci.yml
@@ -57,7 +57,7 @@ jobs:
           role-session-name: JavaScriptTests
 
       - name: Install dependencies
-        run: npm ci --unsafe-perm
+        run: npm ci
 
       - name: Build (for source code testing)
         if: ${{ !inputs.test-published-packages }}

From da82c4501ebe6b5558a0eaed3373eeffada19fcc Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 22:03:01 +0000
Subject: [PATCH 06/11] fix(integration-browser): keep webpack below 5.112

---
 modules/integration-browser/package.json | 2 +-
 package-lock.json                        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/integration-browser/package.json b/modules/integration-browser/package.json
index 04424db73..cc3dbd73d 100644
--- a/modules/integration-browser/package.json
+++ b/modules/integration-browser/package.json
@@ -39,7 +39,7 @@
     "null-loader": "^4.0.1",
     "stream-to-promise": "^3.0.0",
     "tslib": "^2.3.0",
-    "webpack": "^5.42.0",
+    "webpack": ">=5.42.0 <5.112.0",
     "yargs": "^17.0.1"
   },
   "sideEffects": false,
diff --git a/package-lock.json b/package-lock.json
index fddd88512..39dcb4cd8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -407,7 +407,7 @@
         "null-loader": "^4.0.1",
         "stream-to-promise": "^3.0.0",
         "tslib": "^2.3.0",
-        "webpack": "^5.42.0",
+        "webpack": ">=5.42.0 <5.112.0",
         "yargs": "^17.0.1"
       },
       "bin": {

From 690c505c9ec1f1623cc94f75cc9d29c71c88356d Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 22:08:29 +0000
Subject: [PATCH 07/11] test: accept the Node 27 AES-GCM failure message

---
 modules/decrypt-node/test/decrypt.test.ts              |  5 ++++-
 .../test/kms_hkeyring_node.edk-order.test.ts           |  2 +-
 .../test/kms_hkeyring_node.helpers.test.ts             |  4 +++-
 .../kms-keyring-node/test/kms_hkeyring_node.test.ts    | 10 +++++++---
 4 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/modules/decrypt-node/test/decrypt.test.ts b/modules/decrypt-node/test/decrypt.test.ts
index d8e635c39..9b3b85ead 100644
--- a/modules/decrypt-node/test/decrypt.test.ts
+++ b/modules/decrypt-node/test/decrypt.test.ts
@@ -277,7 +277,10 @@ describe('decrypt', () => {
       decrypt(hkeyring, ciphertext, {
         encoding: 'base64',
       })
-    ).to.rejectedWith(Error, 'Unsupported state or unable to authenticate data')
+    ).to.rejectedWith(
+      Error,
+      /Unsupported state or unable to authenticate data|bad decrypt/
+    )
   })
 
   it('will decrypt ciphertext with high utf8 codepoints with a keyring configured to do utf8 sorting', async () => {
diff --git a/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts b/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts
index d8d059818..d10f8f5e2 100644
--- a/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts
+++ b/modules/kms-keyring-node/test/kms_hkeyring_node.edk-order.test.ts
@@ -254,7 +254,7 @@ describe('KmsHierarchicalKeyRingNode: decrypt EDK order', () => {
       `Error #1 \n Error: The encrypted data key ciphertext must be ${ciphertextLength} bytes long`,
       'Error #2 \n Error: Input must represent a uuidv4',
       `Error #3 \n Error: A branch key record with branch-key-id=${branchKeyId} and type=branch:version:${nonExistentBranchKeyVersion} was not found in DynamoDB`,
-      'Error #4 \n Error: Unsupported state or unable to authenticate data',
+      /Error #4 \n Error: (Unsupported state or unable to authenticate data|error:1C800064:Provider routines::bad decrypt)/,
     ]
 
     await testOnDecryptError(
diff --git a/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts b/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts
index 243182d18..6bd29c6f8 100644
--- a/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts
+++ b/modules/kms-keyring-node/test/kms_hkeyring_node.helpers.test.ts
@@ -281,7 +281,9 @@ describe('KmsHierarchicalKeyRingNode: helpers', () => {
             decryptionMaterial,
             utf8Sorting.utf8Sorting
           )
-        ).to.throw('Unsupported state or unable to authenticate data')
+        ).to.throw(
+          /Unsupported state or unable to authenticate data|bad decrypt/
+        )
       }
     })
   })
diff --git a/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts b/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts
index 37daaa0e0..77d3f1a99 100644
--- a/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts
+++ b/modules/kms-keyring-node/test/kms_hkeyring_node.test.ts
@@ -199,7 +199,7 @@ export async function testOnDecryptError(
   edks: EncryptedDataKey[],
   decryptionMaterial: NodeDecryptionMaterial,
   errorMessage?: string,
-  errorMessages?: string[]
+  errorMessages?: (string | RegExp)[]
 ) {
   const expectedNumberOfTraces = decryptionMaterial.keyringTrace.length
   const alreadyHasPdk = decryptionMaterial.hasUnencryptedDataKey
@@ -218,8 +218,12 @@ export async function testOnDecryptError(
       //# then it MUST yield an error that includes all the collected errors
       //# and MUST NOT modify the [decryption materials](structures.md#decryption-materials).
       const errMsg = (error as Error).message
-      for (const expectedError of errorMessages as string[]) {
-        expect(errMsg.includes(expectedError)).to.be.true
+      for (const expectedError of errorMessages as (string | RegExp)[]) {
+        expect(
+          typeof expectedError === 'string'
+            ? errMsg.includes(expectedError)
+            : expectedError.test(errMsg)
+        ).to.be.true
       }
     }
   }

From 49b6f987442efe1874c99b0dba897ef8bc88eb7c Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 22:12:20 +0000
Subject: [PATCH 08/11] ci: test on the newest stable Node, not pre-releases

---
 .github/workflows/shared-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml
index 647f5dc3a..3ba858173 100644
--- a/.github/workflows/shared-ci.yml
+++ b/.github/workflows/shared-ci.yml
@@ -27,7 +27,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ['22.x', '24.x', 'latest']
+        node-version: ['22.x', '24.x', '*']
         test-type: ['node', 'browser']
         # Determine test categories based on whether testing published packages or source code:
         # - Testing published packages: only run vector tests (don't have build artifacts to test coverage or compliance)

From 8efdef54ac6fb978d9551fb0390d7656ace1ad9e Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 22:27:14 +0000
Subject: [PATCH 09/11] ci: print the browser vector install tree on failure

---
 .github/workflows/shared-ci.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml
index 3ba858173..5f589127c 100644
--- a/.github/workflows/shared-ci.yml
+++ b/.github/workflows/shared-ci.yml
@@ -77,6 +77,19 @@ jobs:
           npm run verdaccio-${{ matrix.test-type }}-decrypt
           npm run verdaccio-${{ matrix.test-type }}-encrypt
 
+      - name: Debug browser vector install
+        if: failure() && matrix.test-type == 'browser'
+        run: |
+          for d in ~/.npm/_npx/*/node_modules; do
+            echo "== $d"
+            ls "$d/@aws-crypto" || true
+            jq '{version, dependencies}' "$d/@aws-crypto/caching-materials-manager-browser/package.json" || true
+            jq '{version, dependencies}' "$d/@aws-crypto/integration-browser/package.json" || true
+            jq .version "$d/webpack/package.json" || true
+            find "$d" -path '*node_modules/webpack/package.json' -exec sh -c 'echo "$1 $(jq -r .version "$1")"' _ {} \; || true
+            ls "$d/@aws-crypto/cache-material" "$d/@aws-crypto/cache-material/build/module/src" || true
+          done
+
       - name: Run compliance tests
         # Don't run linting or check Duvet requirements for published packages
         if: ${{ matrix.test-category == 'compliance'}}

From ccfb88c033a34b56e61dedb9ccd3dcaa8cf7a2c1 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 22:39:56 +0000
Subject: [PATCH 10/11] fix(integration-browser): turn off webpack sideEffects
 in the browser test bundle

---
 .github/workflows/shared-ci.yml           | 13 -------------
 modules/integration-browser/karma.conf.js |  3 +++
 modules/integration-browser/package.json  |  2 +-
 package-lock.json                         |  2 +-
 4 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml
index 5f589127c..3ba858173 100644
--- a/.github/workflows/shared-ci.yml
+++ b/.github/workflows/shared-ci.yml
@@ -77,19 +77,6 @@ jobs:
           npm run verdaccio-${{ matrix.test-type }}-decrypt
           npm run verdaccio-${{ matrix.test-type }}-encrypt
 
-      - name: Debug browser vector install
-        if: failure() && matrix.test-type == 'browser'
-        run: |
-          for d in ~/.npm/_npx/*/node_modules; do
-            echo "== $d"
-            ls "$d/@aws-crypto" || true
-            jq '{version, dependencies}' "$d/@aws-crypto/caching-materials-manager-browser/package.json" || true
-            jq '{version, dependencies}' "$d/@aws-crypto/integration-browser/package.json" || true
-            jq .version "$d/webpack/package.json" || true
-            find "$d" -path '*node_modules/webpack/package.json' -exec sh -c 'echo "$1 $(jq -r .version "$1")"' _ {} \; || true
-            ls "$d/@aws-crypto/cache-material" "$d/@aws-crypto/cache-material/build/module/src" || true
-          done
-
       - name: Run compliance tests
         # Don't run linting or check Duvet requirements for published packages
         if: ${{ matrix.test-category == 'compliance'}}
diff --git a/modules/integration-browser/karma.conf.js b/modules/integration-browser/karma.conf.js
index 61e1c7140..461ec39db 100644
--- a/modules/integration-browser/karma.conf.js
+++ b/modules/integration-browser/karma.conf.js
@@ -48,6 +48,9 @@ module.exports = function (config) {
         ]
       },
       mode: 'development',
+      optimization: {
+        sideEffects: false,
+      },
       stats: {
         colors: true,
         modules: true,
diff --git a/modules/integration-browser/package.json b/modules/integration-browser/package.json
index cc3dbd73d..04424db73 100644
--- a/modules/integration-browser/package.json
+++ b/modules/integration-browser/package.json
@@ -39,7 +39,7 @@
     "null-loader": "^4.0.1",
     "stream-to-promise": "^3.0.0",
     "tslib": "^2.3.0",
-    "webpack": ">=5.42.0 <5.112.0",
+    "webpack": "^5.42.0",
     "yargs": "^17.0.1"
   },
   "sideEffects": false,
diff --git a/package-lock.json b/package-lock.json
index 39dcb4cd8..fddd88512 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -407,7 +407,7 @@
         "null-loader": "^4.0.1",
         "stream-to-promise": "^3.0.0",
         "tslib": "^2.3.0",
-        "webpack": ">=5.42.0 <5.112.0",
+        "webpack": "^5.42.0",
         "yargs": "^17.0.1"
       },
       "bin": {

From 0067b1f6591a92c35dc3dd9dfb89886e728782d6 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Thu, 29 Oct 2026 22:49:16 +0000
Subject: [PATCH 11/11] fix(integration-browser): set webpack sideEffects
 through a plugin karma-webpack keeps

---
 modules/integration-browser/karma.conf.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/integration-browser/karma.conf.js b/modules/integration-browser/karma.conf.js
index 461ec39db..92509c012 100644
--- a/modules/integration-browser/karma.conf.js
+++ b/modules/integration-browser/karma.conf.js
@@ -48,9 +48,6 @@ module.exports = function (config) {
         ]
       },
       mode: 'development',
-      optimization: {
-        sideEffects: false,
-      },
       stats: {
         colors: true,
         modules: true,
@@ -61,6 +58,11 @@ module.exports = function (config) {
         new webpack.ProvidePlugin({
           Buffer: ['buffer', 'Buffer'],
         }),
+        {
+          apply(compiler) {
+            compiler.options.optimization.sideEffects = false
+          },
+        },
       ],
       devtool: 'inline-source-map',
       resolve: {