[AshGodfrey]

Why

The daily security scan on main reports 33 findings. Eleven are jackson-databind and httpx2, which #143 handles. This PR clears the other 22, all of which trace back to four dependency floors in generated projects:

• terraform: golang.org/x/net v0.59.0 carries five open Go advisories in net/http2 (GO-2026-6603, -6610, -6611, -6612, -6617: HTTP/2 server memory exhaustion, malformed framing headers, flow-control refund and HPACK race bugs). All are fixed in v0.60.0.
• mcp-typescript: vitest ^3.2.6 is affected by GHSA-82fw-gwwq-j7x9 (path traversal in @vitest/mocker redirect mocks). The 3.x line has no fix; the first patched release is 4.1.11, which requires Node 20.19+. The MCP server already requires Node 20, so it moves; the TypeScript SDK still supports Node 18 (RUNTIMES.md), so it stays on 3.x with an ignore entry explaining why.
• mcp-typescript: the generated server's overrides block pinned floors that have since been passed by new advisories for hono, fast-uri, js-yaml, ip-address and brace-expansion, and express ^5.1.0 resolved proxy-addr 2.0.7 (GHSA-jqcg-44mw-7w3h, critical IP spoofing via IPv4-mapped IPv6 trusted subnets) and qs 6.15.x (GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx).
• typescriptv2 with mcpServer: express ^4.21.2 pulls the same proxy-addr and qs ranges.

What changed

• templates/templates/terraform/config.ts: golang.org/x/net floor v0.59.0 → v0.60.0, in both the template default and additionalDependencyMinimumVersions, so an additionalDependencies pin cannot downgrade below it.
• templates/templates/mcp-typescript/config.ts: vitest ^3.2.6 → ^4.1.11. Vitest 4 declares Node 20+ and an optional @types/node peer of ^20 || ^22 || >=24; with @types/node ^18 in the same tree, npm 11 aborts resolution (Cannot read properties of null (reading 'children') in arborist), so @types/node moves to ^20.19.0 alongside it. Vitest 4 pulls Vite 8, which needs Node 20.19, so the generated engines.node and the installation README move from >=20 to >=20.19.0 (the Gram variant already requires 22.18).
• .security-ignore.json: GHSA-82fw-gwwq-j7x9 ignored for the TypeScript SDK, which keeps vitest ^3.2.6 and @types/node ^18 so generated test suites still run on Node 18.
• templates/templates/typescriptv2/config.ts: express ^4.21.2 → ^4.22.3, whose dependency ranges resolve qs 6.16 and proxy-addr 2.0.8.
• templates/templates/mcp-typescript/config.ts: express ^5.1.0 → ^5.3.0, which requires proxy-addr ^2.0.8 and qs ^6.16.0 directly.
• templates/templates/mcp-typescript/package.json.stmpl: override floors raised to the first patched versions (hono >=4.13.11, fast-uri >=4.1.5, js-yaml >=4.3.2, ip-address >=10.7.4, brace-expansion >=2.1.7) and proxy-addr >=2.0.8 and qs >=6.16.0 added so existing lockfiles move on the next install.
• Review outputs regenerated: zSDKs/mcp-typescript (package.json and lockfile; the lockfile also picks up @modelcontextprotocol/sdk 1.32.1, which the template already required but the checked-in lockfile predated) and zSDKs/terraform-provider-testing (go.mod/go.sum). The TypeScript review SDK does not enable mcpServer, so its output is unchanged.

Not touched: jackson-databind and httpx2 (#143), and the existing entries in .security-ignore.json, which still apply.

Testing

• go run ./cmd/security -scan -osv-severity=low -npm-audit=moderate on this branch: 33 findings → 11, and all 11 are the jackson-databind and httpx2 rows fix(java,python): bump jackson-databind to 2.22.4 and the httpx2 floor to 2.12.0 #143 fixes. The npm audit of both TypeScript review projects is clean.
• TARGET=review make test-typescriptv2: 7 files, 38 passed, 4 skipped (also verified earlier under vitest 4 before the Node 18 decision).
• make test-mcp-typescript (review): generation, npm install, tsc, lint and the mock-server lint pass; the review variant has no vitest suite, so the MCP test groups in CI are the runtime check.
• zSDKs/terraform-provider-testing: go mod tidy and go build ./... pass with x/net v0.60.0.
• prettier and git diff --check are clean on the template changes.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check.

---

Summary by cubic

Raises dependency floors in the terraform, typescriptv2, and mcp-typescript templates to clear the daily security scan findings; the remaining jackson-databind/httpx2 advisories are handled separately, and the vitest path traversal is accepted for the TypeScript SDK.

• terraform: golang.org/x/net raised to v0.60.0 and added to additionalDependencyMinimumVersions so older explicit pins can't downgrade past the patched release.
• mcp-typescript: vitest raised to ^4.1.11 with @types/node ^20.19.0 and a Node >=20.19.0 engine floor.
• mcp-typescript: express raised to ^5.3.0 and npm override floors lifted for hono, fast-uri, js-yaml, ip-address, brace-expansion, plus new proxy-addr and qs overrides.
• typescriptv2: express raised to ^4.22.3.
• The TypeScript SDK stays on vitest 3.x for Node 18 support; its advisory is added to .security-ignore.json.
• Regenerated review outputs and lockfiles with npm 11.6; the MCP lockfile also picks up the already-required @modelcontextprotocol/sdk 1.32.1.

^{Written for commit 8162106. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 15 files

Confidence score: 3/5

• Generated MCP packages advertise support for Node 20 versions that Vite 8 requires to be newer than, which can cause compatibility problems for users below 20.19. Update the Node floor and installation docs in templates/templates/mcp-typescript/config.ts to >=20.19.0.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="templates/templates/mcp-typescript/config.ts">

<violation number="1" location="templates/templates/mcp-typescript/config.ts:256">
P2: This Vitest 4 range pulls Vite 8, which requires Node 20.19 or newer, but generated MCP packages still advertise Node `>=20`. Raise the MCP Node floor to `>=20.19.0` and update its installation documentation.</violation>
</file>

<sub>Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[speakeasy-generator-bot]

Generator Snapshot Testing

Snapshot tests are running.

Snapshot results: https://github.com/speakeasy-api/openapi-generation-snapshots/issues/132#issuecomment-6363150155

[cubic-dev-ai]

All reported issues were addressed across 10 files (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 2 unresolved issues from previous reviews.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>