Generated SDK Sandbox devcontainer pins an EOL Node base image (typescript-node:1-20-bullseye)

[timhaines]

Summary

generation.devContainers.enabled: true generates .devcontainer/devcontainer.json with image: mcr.microsoft.com/devcontainers/typescript-node:1-20-bullseye. Node 20 reached end-of-life on 2026-04-30, so every TypeScript SDK with sandboxes enabled ships an EOL runtime to anyone opening the Codespace.

Additional concerns

• The generated .devcontainer/setup.sh uses npm install --ignore-scripts + global ts-node. SDK repos that standardize on pnpm/yarn (and on strict supply-chain settings) get a sandbox that bypasses their lockfile and install policy.
• There appears to be no gen.yaml knob for the base image, Node version, or package manager — devContainers documents only enabled and schemaPath (SDK Sandboxes, gen.yaml reference). So consumers can't fix this in place; the only remediation is disabling the feature entirely.

Requests

1. Bump the generated TS devcontainer base image to a supported Node LTS (>=22), and keep it tracking LTS going forward.
2. Consider honoring the SDK's declared engines.node when selecting the image tag.
3. Optionally, expose a devContainers.baseImage (and/or package-manager) override in gen.yaml for repos that need it.

Generator/CLI version: Speakeasy CLI as pinned in our .speakeasy/workflow.yaml. TypeScript target.

[AshGodfrey]

Hi Tim, we'll take a look. Thank you!