fix(terraform,typescript,mcp): raise x/net, vitest, express and MCP server override floors past open advisories

.changesets/1792751509-adb06fbd.yaml

@@ -0,0 +1,12 @@
+id: 1792751509-adb06fbd
+features:
+    - core
+targets:
+    - terraform
+    - typescriptv2
+    - mcp-typescript
+type: fix
+bump: patch
+description: raise the golang.org/x/net floor to v0.60.0, move the MCP server to vitest 4.1.11 with @types/node 20 and a Node 20.19 engine floor, bump the express floors, and lift the MCP server npm overrides so generated projects resolve patched hono, fast-uri, js-yaml, ip-address, brace-expansion, proxy-addr and qs
+author: AshGodfrey
+date: "2026-10-23"

.security-ignore.json

@@ -39,6 +39,11 @@
       "id": "GO-2026-5932",
       "package": "golang.org/x/crypto",
       "reason": "x/crypto/openpgp is unmaintained by design and the advisory has no fixed version, so no bump can ever clear it. Not reachable: the generated Terraform provider does not import any golang.org/x/crypto/openpgp packages; x/crypto is only a transitive dep of the Terraform plugin stack"
+    },
+    {
+      "id": "GHSA-82fw-gwwq-j7x9",
+      "package": "vitest",
+      "reason": "Path traversal via @vitest/mocker redirect mocks - dev-only test runner, and generated tests never use redirect mocks or expose the mocker over a network. No fix exists on the 3.x line; the first patched release is 4.1.11, which drops Node 18 while the TypeScript SDK still supports Node 18 (RUNTIMES.md). The MCP server target, whose Node floor is already 20+, moved to 4.1.11; revisit when the SDK's Node floor moves to 20"
     }
   ]
 }

templates/templates/mcp-typescript/config.ts

@@ -65,7 +65,7 @@ function getTemplateDependencies() {
     // Runtime dependencies
     express: {
       name: "express",
-      version: "^5.1.0",
+      version: "^5.3.0",
       cpe: "cpe:2.3:a:expressjs:express:*:*:*:*:*:node.js:*:*",
       ecosystem: "npm",
       category: "runtime",
@@ -223,7 +223,7 @@ function getTemplateDependencies() {
     },
     "@types/node": {
       name: "@types/node",
-      version: "^18.19.3",
+      version: "^20.19.0",
       cpe: "cpe:2.3:a:definitelytyped:types-node:*:*:*:*:*:node.js:*:*",
       ecosystem: "npm",
       category: "dev",
@@ -253,7 +253,7 @@ function getTemplateDependencies() {
     },
     vitest: {
       name: "vitest",
-      version: "^3.2.6",
+      version: "^4.1.11",
       cpe: "cpe:2.3:a:vitest:vitest:*:*:*:*:*:node.js:*:*",
       ecosystem: "npm",
       category: "dev",

templates/templates/mcp-typescript/package.json.stmpl

@@ -54,18 +54,20 @@
   },
   {{- end }}
   "overrides": {
-    "hono": ">=4.12.34",
-    "fast-uri": ">=4.1.2 <5.0.0",
-    "js-yaml": ">=4.3.1 <5.0.0",
-    "ip-address": ">=10.3.1 <11.0.0",
+    "hono": ">=4.13.11",
+    "fast-uri": ">=4.1.5 <5.0.0",
+    "js-yaml": ">=4.3.2 <5.0.0",
+    "ip-address": ">=10.7.4 <11.0.0",
     "nanoid@^5.0.0": ">=5.1.16 <6.0.0",
-    "brace-expansion@^2.0.0": ">=2.1.4 <3.0.0",
-    "body-parser": ">=2.3.0 <3.0.0"
+    "brace-expansion@^2.0.0": ">=2.1.7 <3.0.0",
+    "body-parser": ">=2.3.0 <3.0.0",
+    "proxy-addr": ">=2.0.8 <3.0.0",
+    "qs": ">=6.16.0 <7.0.0"
   },
   "devDependencies": {
     {{ templateDevDependencies | indent 4 | trim }}
   },
   "engines": {
-    "node": "{{ if .Global.Config.GramEnabled }}>=22.18.0{{ else }}>=20{{ end }}"
+    "node": "{{ if .Global.Config.GramEnabled }}>=22.18.0{{ else }}>=20.19.0{{ end }}"
   }
 }

templates/templates/mcp-typescript/readme/installation.stmpl

@@ -1,6 +1,6 @@
 {{- $flags := generateMCPFlagsUsage -}}
 
-The MCP server requires Node.js {{ if .Global.Config.GramEnabled }}22.18.0 or later because Gram is enabled{{ else }}20 or later{{ end }}.
+The MCP server requires Node.js {{ if .Global.Config.GramEnabled }}22.18.0 or later because Gram is enabled{{ else }}20.19.0 or later{{ end }}.
 {{- $packageName := .Global.Config.PackageName -}}
 
 {{- if not .Global.Config.Published }}

templates/templates/terraform/config.ts

@@ -64,7 +64,7 @@ function getTemplateDependencies() {
     },
     "golang.org/x/net": {
       name: "golang.org/x/net",
-      version: "v0.59.0",
+      version: "v0.60.0",
       cpe: "cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*",
       ecosystem: "Go",
       category: "runtime",
@@ -150,7 +150,7 @@ const additionalDependencyMinimumVersions: Record<string, string> = {
   // defaults, so without these minimums a customer explicitly pinning an
   // older version would silently downgrade below the patched releases.
   "golang.org/x/crypto": "v0.57.0",
-  "golang.org/x/net": "v0.59.0",
+  "golang.org/x/net": "v0.60.0",
   "golang.org/x/text": "v0.42.0",
   "google.golang.org/grpc": "v1.83.2",
 };

templates/templates/typescriptv2/config.ts

@@ -288,7 +288,7 @@ function getTemplateDependencies() {
     },
     express: {
       name: "express",
-      version: "^4.21.2",
+      version: "^4.22.3",
       cpe: "cpe:2.3:a:expressjs:express:*:*:*:*:*:node.js:*:*",
       ecosystem: "npm",
       category: "dev",