fix: zip-slip hardening in updater + security dependency bumps

[ThomasRooney]

Fixes SEC-39

Summary

Fixes the remaining Aikido Critical/High findings in this repo:

• Zip-slip (internal/updates/updates.go, 3 findings): archive entries are now validated to stay inside the extraction directory in both extractZip and extractTarGZ via a shared securePath helper. Tar file entries also get parent directories created before write.
• Predictable temp file (internal/ci/git/releases.go): goreleaser config now written via os.CreateTemp instead of fixed /tmp/.goreleaser.yml.
• Go deps: x/crypto → v0.52.0, x/net → v0.55.0, grpc → v1.79.3 (AIKIDO-2026-11022 family, -11039, CVE-2026-33186).
• JS deps (internal/defaultcodesamples): npm overrides constrain jsonpath-plus to ^10.3.0 (resolves to 10.4.0 in the lockfile; CVE-2024-21534 fixed in 10.2.0, CVE-2025-1302 in 10.3.0) and lodash ^4.18.1 (CVE-2026-4800).

Verification

• go build ./... clean
• defaultcodesamples: npm run build + vitest pass (8 passed, 1 skipped, 3 todo)

---

Summary by cubic

Hardened archive extraction to block zip‑slip and removed a predictable temp file in the release flow. Also bumps Go and JS dependencies to address Aikido Critical/High findings (SEC‑34).

• Bug Fixes

  • Updater: validate archive entry paths via securePath, create parent dirs for tar entries, and use errors.Is for io.EOF in extractTarGZ.
  • Release CI: write the goreleaser config to a unique os.CreateTemp file and use WriteString instead of a fixed /tmp/.goreleaser.yml.

• Dependencies

  • Go: golang.org/x/crypto → v0.52.0, golang.org/x/net → v0.55.0, google.golang.org/grpc → v1.79.3; also bumped golang.org/x/{oauth2,term,text,mod,sys,tools}.
  • JS (in internal/defaultcodesamples): add overrides for jsonpath-plus ^10.3.0 and lodash ^4.18.1.

^{Written for commit c1cf8b9. Summary will update on new commits.}

Follow-up (2026-08-04): the grpc 1.79.3 bump here was insufficient for GHSA-hrxh-6v49-42gf (first patched in 1.82.1); that bump, removal of the vulnerable github.com/docker/docker dependency (CVE-2026-34040), and studio server hardening landed in #2107.

[linear-code]

SEC-34

SEC-39

[cubic-dev-ai]

No issues found across 6 files

_{Re-trigger cubic}

[ThomasRooney]

Pushed errorlint fix (errors.Is(err, io.EOF)). Note: the Build & Test (windows-latest) failure is pre-existing — the same job failed on #2105 (merged earlier today); TestQuickstart/{csharp,go,mcp-typescript,python} hang until the 20m suite timeout, unrelated to this diff.

[AshGodfrey]

Your PR description lists a different version (The overrides entry says ^10.3.0 while the PR description seems to imply^10.4.0 - can you double check that?)

[ThomasRooney]

Good catch — that was a wording slip in the description, not a version mismatch in the code. The override is a range, not a pin:

• internal/defaultcodesamples/package.json overrides: jsonpath-plus: ^10.3.0
• package-lock.json resolves that to 10.4.0

Both CVEs are covered by ^10.3.0 (CVE-2024-21534 fixed in 10.2.0, CVE-2025-1302 in 10.3.0); the lockfile just picked up the latest 10.x patch. I've corrected the description to say ^10.3.0 → resolves to 10.4.0 so it matches the diff.