Track 0.11.1 release blockers: generated dependency advisories and registry resolution #666

Resolved security blockers

Fixed by #667 and #668. The latter merged as a5e71b9 after all eight test jobs and DCO passed in run 42707814062.

• Go: Avrotize 3.9.5 is published and required. Its maintained iskorotkov/avro v2.33.0 decoder bounds arrays and maps to 1,048,576 entries each. All ten generated module graphs pass govulncheck; standard CI installs the published wheel and passes all 25 Go tests. Generated Go projects require Go 1.26 or newer.
• TypeScript: the selected TypeScript 5.9 baseline, compatible Jest tooling and propagated overrides resolve the audited advisories. Fresh OSV checks found no advisories in the Kafka, MQTT, HTTP, dashboard, Event Hubs, Event Grid and both Service Bus graphs. The dashboard builds; MQTT and Kafka runtime checks and JSON Patch validation/migration checks pass. Azure Jest ESM proxy handling and Event Grid timestamp types are fixed. The complete TypeScript CI job passes.
• Python: fresh local CLI and generated-SDK audits found no advisories across 88 and 60 resolved packages respectively. An OSV check of 96 actual CI-installed package/version pairs also found none. The paho-mqtt minimum now uses the available 2.1 release. CI verifies normal installation and generation with published Avrotize 3.9.5.
• The extension npm audit, three central NuGet graphs, central Java OSV audit and generated Rust cargo-audit were clean after remediation. System.Memory.Data 10.0.13 also matches the updated generated C# data projects.

Deferred non-security work

#660 remains open because the configured npm registry still returns E404 for nock 15.0.6. Nock 14 has no advisory in the resolved audits. Estimate after package availability: 1-2 engineering hours for Node/Jest ESM compatibility and focused checks; registry repair lead time is unknown.

The full TypeScript HTTP producer build has an existing CommonJS formats.js hook inside a type:module package. The patched JSON Patch API paths pass, but the complete HTTP build is not reported as fixed. Estimate for a separate hook/module-format fix and focused build: 1-2 engineering hours. Both estimates are engineering estimates, not measured durations.

Environment limitations

The shared machine's global Go 1.27.0 installation was not changed; local checks used isolated Go 1.27.3. The local Python mirror still lacks Avrotize 3.9.5 and direct file downloads fail TLS. GitHub CI supplies the published-wheel verification. TLS verification and global registry settings were not changed.

Prepared release

The unpublished v0.11.1 draft now targets a5e71b9. Wheel and sdist were rebuilt from a clean worktree, both declare Avrotize >=3.9.5, and all 609 tracked package source files match the artifacts. Uploaded SHA256 digests match local verification. Release notes disclose the remaining Nock and HTTP limitations. No v0.11.1 tag has been pushed and codegen has not been published.