[clemensv]

Maintenance changes

Integrates the original heads of 23 Dependabot PRs without bypassing branch protection. Adjacent .NET version conflicts retain the newer version of each package. A merge commit is required to preserve original PR ancestry; do not squash this aggregate PR.

Includes #602, #604, #606, #607, #609, #610, #611, #613, #615, #616, #617, #618, #619, #620, #622, #623, #627, #628, #630, #631, #632, #655 and #659.

#660 is excluded: the configured npm registry does not provide nock 15.0.6. The PR contains the estimate and compatibility assessment.

Additional fixes:

• Raise vulnerable Jinja2, pytest and Python Avro minimum versions.
• Update Testcontainers to 4.16.0 across .NET 8/9/10 to remove vulnerable SSH.NET.
• Update Java parents and Jackson; explicitly resolve patched Kafka LZ4/Snappy libraries in generated projects.
• Refresh the extension lockfile, update esbuild/glob/Mocha, and apply scoped transitive overrides.
• Load ESM-only Mocha asynchronously while preserving the extension's CommonJS output.
• Use the Go 1.26 CI patch line to satisfy OpenTelemetry's existing requirement.

Evidence

Focused core tests: 23 passed. Previously failing generated Go Event Hubs producer: passed. Generated Java Kafka flush tests: 3 passed. Extension utility tests: 22 passed; compilation, lint (pre-existing warnings only), and bundle succeeded. Python source and wheel distributions built as 0.11.1.

Audits: extension npm zero; all three .NET NuGet trees zero; central Java and declared/minimum OSV scan zero; generated Rust cargo-audit zero across 157 dependencies. GitHub has no open Dependabot alerts.

Release status and limitations

This PR does not certify every generated SDK as vulnerability-free. Generated Go Avro has advisories without a fixed hamba release; x/net also needs follow-up. The central TypeScript manifest has a peer-version conflict and moderate/low transitive findings. Fresh Python resolution is blocked by registry/TLS failures and an unavailable existing paho-mqtt floor. #666 records exact findings and estimated effort.

Prepare v0.11.1 as an unpublished draft only. Do not push a release tag or publish packages while these unresolved risks lack an explicit release decision.