fix(seed): repair broken ts-seed and csharp-seed Dockerfile builds

[davidkonigsberg]

Description

Linear ticket: N/A

docker/seed/Dockerfile.ts and docker/seed/Dockerfile.csharp have been failing on main since:

• ts-seed: 2026-04-01 — every push since then has failed on RUN corepack prepare pnpm@10.20.0 with Internal Error: Cannot find matching keyid (nodejs/corepack#612). The version of corepack bundled with node:22.12-slim ships with outdated signing keys and rejects newer pnpm/yarn releases.
• csharp-seed: 2026-04-01 (PR #14429, chore(csharp): upgrade WireMock.Net from 1.25.0 to 2.2.0) — dotnet restore /dependencies.csproj fails with NU1605 package downgrade errors:
  • WireMock.Net 2.2.0 → WireMock.Net.Minimal 2.2.0 → Scriban.Signed 7.0.6 → System.Text.Json (>= 10.0.5) conflicts with the pinned 8.0.5.
  • Grpc.Net.ClientFactory 2.63.0 → Microsoft.Extensions.Http 6.0.0 → Microsoft.Extensions.Logging 10.0.0 → Microsoft.Extensions.Logging.Abstractions (>= 10.0.0) conflicts with the pinned 8.0.2.

These two images are referenced from the new grype scan matrix in #15729, where the failures were surfaced again.

Changes Made

• docker/seed/Dockerfile.ts: prepend RUN npm install -g corepack@latest so corepack has up-to-date signing keys before corepack prepare runs. Added a comment explaining why.
• docker/seed/Dockerfile.csharp: bump warmup-cache dependencies.csproj versions to satisfy transitive constraints from WireMock.Net 2.2.0 and Grpc.Net.ClientFactory 2.63.0:
  • System.Text.Json: 8.0.5 → 10.0.5
  • Microsoft.Extensions.Logging.Abstractions: 8.0.2 → 10.0.0

Testing

• Built docker/seed/Dockerfile.ts locally — passes (Successfully tagged fern-ts-seed-test:local).
• Built docker/seed/Dockerfile.csharp locally — passes; dotnet restore /dependencies.csproj reports Restored /dependencies.csproj (in 7.18 sec). with no NU1605 errors (only a few benign NU1701 netstandard2.0 compatibility warnings, unchanged from before).
• CI: Build seed containers workflow on this PR.

Link to Devin session: https://app.devin.ai/sessions/4363b615bc51422483ddb7d519a4ee12
Requested by: @davidkonigsberg

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[github-actions]

🌱 Seed Test Selector

Select languages to run seed tests for:

• Python
• TypeScript
• Java
• Go
• Ruby
• C#
• PHP
• Swift
• Rust
• OpenAPI

---

How to use: Click the ⋯ menu above → "Edit" → check the boxes you want → click "Update comment". Tests will run automatically and snapshots will be committed to this PR.

[github-actions]

SDK Generation Benchmark Results

Comparing PR branch against median of 5 nightly run(s) on main (latest: 2026-04-23T04:59:11Z).

Full benchmark table (click to expand)

Generator	Spec	main (generator)	main (E2E)	PR (generator)	Delta
csharp-sdk	square	56s (n=5)	86s (n=5)	67s	+11s (+19.6%)
ts-sdk	square	74s (n=5)	86s (n=5)	82s	+8s (+10.8%)

main (generator): generator-only time via --skip-scripts (includes Docker image build, container startup, IR parsing, and code generation — this is the same Docker-based flow customers use via fern generate). main (E2E): full customer-observable time including build/test scripts (nightly baseline, informational). Delta is computed against generator-only baseline.
⚠️ = generation exited with a non-zero exit code (timing may not reflect a successful run).
Baseline from nightly runs on main (latest: 2026-04-23T04:59:11Z). Trigger benchmark-baseline to refresh.
Last updated: 2026-05-06 12:38 UTC

[devin-ai-integration]

Closing as superseded — both Dockerfiles were already remediated on main while this PR was open:

• ts-seed — chore(seed): remediate ts-seed container vulnerabilities #15734 (chore(seed): remediate ts-seed container vulnerabilities) bumped the base image node:22.12-slim → node:24.15.0-trixie-slim and pnpm 10.20.0 → 10.33.3. The newer base image ships a corepack with up-to-date signing keys, which fixes the Cannot find matching keyid error this PR was targeting.
• csharp-seed — fix(seed): remediate 35 csharp-seed container CVEs #15735 (fix(seed): remediate 35 csharp-seed container CVEs) bumped System.Text.Json 8.0.5 → 10.0.5 and Microsoft.Extensions.Logging.Abstractions 8.0.2 → 10.0.0 (the exact same bumps this PR proposed) plus additional CVE remediations (apt OS patches, Portable.System.DateTimeOnly 8.0.2 → 9.0.1, explicit overrides for vulnerable transitives).

Nothing left to do here. Closing.