fix(terraform,typescript,mcp): raise x/net, vitest, express and MCP server override floors past open advisories

Merged
AS
11h ago
+718-665

Why

The daily security scan on main reports 33 findings. Eleven are jackson-databind and httpx2, which #143 handles. This PR clears the other 22, all of which trace back to four dependency floors in generated projects:

  • terraform: golang.org/x/net v0.59.0 carries five open Go advisories in net/http2 (GO-2026-6603, -6610, -6611, -6612, -6617: HTTP/2 server memory exhaustion, malformed framing headers, flow-control refund and HPACK race bugs). All are fixed in v0.60.0.
  • mcp-typescript: vitest ^3.2.6 is affected by GHSA-82fw-gwwq-j7x9 (path traversal in @vitest/mocker redirect mocks). The 3.x line has no fix; the first patched release is 4.1.11, which requires Node 20.19+. The MCP server already requires Node 20, so it moves; the TypeScript SDK still supports Node 18 (RUNTIMES.md), so it stays on 3.x with an ignore entry explaining why.
  • mcp-typescript: the generated server's overrides block pinned floors that have since been passed by new advisories for hono, fast-uri, js-yaml, ip-address and brace-expansion, and express ^5.1.0 resolved proxy-addr 2.0.7 (GHSA-jqcg-44mw-7w3h, critical IP spoofing via IPv4-mapped IPv6 trusted subnets) and qs 6.15.x (GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx).
  • typescriptv2 with mcpServer: express ^4.21.2 pulls the same proxy-addr and qs ranges.

What changed

  • templates/templates/terraform/config.ts: golang.org/x/net floor v0.59.0 → v0.60.0, in both the template default and additionalDependencyMinimumVersions, so an additionalDependencies pin cannot downgrade below it.
  • templates/templates/mcp-typescript/config.ts: vitest ^3.2.6 → ^4.1.11. Vitest 4 declares Node 20+ and an optional @types/node peer of ^20 || ^22 || >=24; with @types/node ^18 in the same tree, npm 11 aborts resolution (Cannot read properties of null (reading 'children') in arborist), so @types/node moves to ^20.19.0 alongside it. Vitest 4 pulls Vite 8, which needs Node 20.19, so the generated engines.node and the installation README move from >=20 to >=20.19.0 (the Gram variant already requires 22.18).
  • .security-ignore.json: GHSA-82fw-gwwq-j7x9 ignored for the TypeScript SDK, which keeps vitest ^3.2.6 and @types/node ^18 so generated test suites still run on Node 18.
  • templates/templates/typescriptv2/config.ts: express ^4.21.2 → ^4.22.3, whose dependency ranges resolve qs 6.16 and proxy-addr 2.0.8.
  • templates/templates/mcp-typescript/config.ts: express ^5.1.0 → ^5.3.0, which requires proxy-addr ^2.0.8 and qs ^6.16.0 directly.
  • templates/templates/mcp-typescript/package.json.stmpl: override floors raised to the first patched versions (hono >=4.13.11, fast-uri >=4.1.5, js-yaml >=4.3.2, ip-address >=10.7.4, brace-expansion >=2.1.7) and proxy-addr >=2.0.8 and qs >=6.16.0 added so existing lockfiles move on the next install.
  • Review outputs regenerated: zSDKs/mcp-typescript (package.json and lockfile; the lockfile also picks up @modelcontextprotocol/sdk 1.32.1, which the template already required but the checked-in lockfile predated) and zSDKs/terraform-provider-testing (go.mod/go.sum). The TypeScript review SDK does not enable mcpServer, so its output is unchanged.

Not touched: jackson-databind and httpx2 (#143), and the existing entries in .security-ignore.json, which still apply.

Testing

  • go run ./cmd/security -scan -osv-severity=low -npm-audit=moderate on this branch: 33 findings → 11, and all 11 are the jackson-databind and httpx2 rows #143 fixes. The npm audit of both TypeScript review projects is clean.
  • TARGET=review make test-typescriptv2: 7 files, 38 passed, 4 skipped (also verified earlier under vitest 4 before the Node 18 decision).
  • make test-mcp-typescript (review): generation, npm install, tsc, lint and the mock-server lint pass; the review variant has no vitest suite, so the MCP test groups in CI are the runtime check.
  • zSDKs/terraform-provider-testing: go mod tidy and go build ./... pass with x/net v0.60.0.
  • prettier and git diff --check are clean on the template changes.

Public-safety check

  • This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
  • Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
  • Generated fixtures and review SDK changes are public-safe.
  • I reviewed git diff --check.

Summary by cubic

Raises dependency floors in the terraform, typescriptv2, and mcp-typescript templates to clear the daily security scan findings; the remaining jackson-databind/httpx2 advisories are handled separately, and the vitest path traversal is accepted for the TypeScript SDK.

  • terraform: golang.org/x/net raised to v0.60.0 and added to additionalDependencyMinimumVersions so older explicit pins can't downgrade past the patched release.
  • mcp-typescript: vitest raised to ^4.1.11 with @types/node ^20.19.0 and a Node >=20.19.0 engine floor.
  • mcp-typescript: express raised to ^5.3.0 and npm override floors lifted for hono, fast-uri, js-yaml, ip-address, brace-expansion, plus new proxy-addr and qs overrides.
  • typescriptv2: express raised to ^4.22.3.
  • The TypeScript SDK stays on vitest 3.x for Node 18 support; its advisory is added to .security-ignore.json.
  • Regenerated review outputs and lockfiles with npm 11.6; the MCP lockfile also picks up the already-required @modelcontextprotocol/sdk 1.32.1.