[clemensv]

Changes

• Require published Avrotize 3.9.5 for maintained Go Avro decoding with bounded arrays/maps (fix(go): use patched Avro codec with bounded collection decoding clemensv/avrotize#557).
• Align Go transport dependencies, Testcontainers and generated-test imports.
• Use the selected TypeScript 5.9 baseline, compatible Jest tooling and patched transitive overrides in generated projects.
• Upgrade the dashboard to Angular 21.2 and fix coupled build compatibility.
• Preserve MQTT CloudEvents handling with SDK 10 and update MQTT callback types.
• Use the available paho-mqtt 2.1 release.

Evidence

• Seven dependency-propagation cases pass.
• All ten generated Go module graphs pass govulncheck; Event Hubs runtime tests pass and the other nine styles compile.
• Fresh TypeScript OSV graphs for Kafka, MQTT, HTTP, dashboard and Event Hubs contain no advisories. MQTT 18 tests, Kafka 7 tests, the complete dashboard build and AJV JSON Patch compatibility checks pass.
• Previous fresh Python audits found no advisories across 88 CLI and 60 generated-SDK packages.
• Avrotize 3.9.5 publication passed all upstream release tests and published Marketplace, Avrotize and Structurize successfully.

Remaining limitations

• Dependabot chore(deps): Bump nock from 14.0.17 to 15.0.6 in /xrcg/dependencies/typescript/node22 #660 stays deferred: the configured registry still cannot supply nock 15.0.6.
• The full HTTP producer build hits an unchanged CommonJS formats.js under type:module; this is separate from the patched JSON Patch API, whose validation/migration paths pass.
• The local mirror has not indexed Avrotize 3.9.5 and direct file downloads fail TLS; standard GitHub CI verified normal installation and generation using the published wheel.

All eight test jobs and DCO passed at 059f44b in run 42707814062. Merged as a5e71b9. Resolves the security blockers in #666. The v0.11.1 draft remains unpublished.

[clemensv]

First CI run confirmed the published avrotize-3.9.5 wheel was downloaded and installed; all 25 Go tests passed, as did Java, RabbitMQ, Rust and the other-language group. Its failures were traced to two version mismatches: System.Memory.Data 10.0.11 versus the data generator's 10.0.13, and Node 20 versus updated TypeScript test dependencies requiring Node 22. Commit 65092e5 aligns both. The focused C# build passes locally with the updated generator source, and actionlint passes. Required CI is running again.

[clemensv]

The tag-build and Marketplace packaging workflows also used Node 20; commit 9ea2318 moves those to Node 22 so release tooling stays consistent. The superseded CI run 42699801761 was cancelled after the new commit to avoid duplicate runners. All three edited workflows pass actionlint. OSV checks of the 96 Python package versions installed by the successful published-wheel Go CI found no advisories.

[clemensv]

Resolved the remaining Azure TypeScript compatibility failures: generated Jest configurations transform the ESM proxy dependency chain, and Event Grid send inputs convert CloudEvent timestamps to the Azure SDK Date representation. Event Grid builds and all six fixture tests pass locally. Both Service Bus projects build and load the updated dependency chain; local emulator execution was intentionally skipped, so actual broker coverage remains the normal Linux CI run. Fresh OSV audits of the three resolved dependency graphs found no advisories (Event Grid: 396 package/version pairs; Service Bus producer: 504; consumer: 503).