chore(deps): pin dependencies and enforce 14-day update cooldown (#27948)

packages/cli/src/acp/acpSession.test.ts

@@ -278,7 +278,8 @@ describe('Session', () => {
         void,
         unknown
       > {
-        yield* [];
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        yield* [] as any;
         throw error;
       }
       return errorGen();
@@ -303,7 +304,8 @@ describe('Session', () => {
         void,
         unknown
       > {
-        yield* [];
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        yield* [] as any;
         throw error;
       }
       return errorGen();
@@ -473,7 +475,8 @@ describe('Session', () => {
         void,
         unknown
       > {
-        yield* [];
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        yield* [] as any;
         throw customError;
       }
       return errorGen();

packages/cli/src/commands/extensions/examples/mcp-server/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "main": "example.js",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.23.0",
-    "zod": "^3.22.4"
+    "@modelcontextprotocol/sdk": "1.23.0",
+    "zod": "3.22.4"
   }
 }

packages/cli/src/config/extensions/extensionEnablement.test.ts

@@ -71,7 +71,7 @@ describe('ExtensionEnablementManager', () => {
     vi.spyOn(fs, 'writeFileSync').mockImplementation(
       (
         path: fs.PathOrFileDescriptor,
-        data: string | ArrayBufferView<ArrayBufferLike>,
+        data: string | NodeJS.ArrayBufferView,
       ) => {
         inMemoryFs[path.toString()] = data.toString(); // Convert ArrayBufferView to string for inMemoryFs
       },

packages/cli/src/config/extensions/update.ts

@@ -156,25 +156,26 @@ export async function updateAllUpdatableExtensions(
   dispatch: (action: ExtensionUpdateAction) => void,
   enableExtensionReloading?: boolean,
 ): Promise<ExtensionUpdateInfo[]> {
-  return (
-    await Promise.all(
-      extensions
-        .filter(
-          (extension) =>
-            extensionsState.get(extension.name)?.status ===
-            ExtensionUpdateState.UPDATE_AVAILABLE,
-        )
-        .map((extension) =>
-          updateExtension(
-            extension,
-            extensionManager,
-            extensionsState.get(extension.name)!.status,
-            dispatch,
-            enableExtensionReloading,
-          ),
+  const results = await Promise.all(
+    extensions
+      .filter(
+        (extension) =>
+          extensionsState.get(extension.name)?.status ===
+          ExtensionUpdateState.UPDATE_AVAILABLE,
+      )
+      .map((extension) =>
+        updateExtension(
+          extension,
+          extensionManager,
+          extensionsState.get(extension.name)!.status,
+          dispatch,
+          enableExtensionReloading,
         ),
-    )
-  ).filter((updateInfo) => !!updateInfo);
+      ),
+  );
+  return results.filter(
+    (updateInfo): updateInfo is ExtensionUpdateInfo => !!updateInfo,
+  );
 }
 
 export interface ExtensionUpdateCheckResult {

packages/cli/src/config/extensions/variables.ts

@@ -52,9 +52,10 @@ export function validateVariables(
 export function hydrateString(str: string, context: VariableContext): string {
   validateVariables(context, VARIABLE_SCHEMA);
   const regex = /\${(.*?)}/g;
-  return str.replace(regex, (match, key) =>
-    context[key] == null ? match : context[key],
-  );
+  return str.replace(regex, (match, key) => {
+    const val = context[key];
+    return val == null ? match : String(val);
+  });
 }
 
 export function recursivelyHydrateStrings<T>(

packages/cli/src/gemini.tsx

@@ -657,7 +657,7 @@ export async function main() {
     // Register SessionEnd hook to fire on graceful exit
     // This runs before telemetry shutdown in runExitCleanup()
     registerCleanup(async () => {
-      await config.getHookSystem()?.fireSessionEndEvent(SessionEndReason.Exit);
+      await config?.getHookSystem()?.fireSessionEndEvent(SessionEndReason.Exit);
     });
 
     // Register ConsolePatcher cleanup last to ensure logs from shutdown hooks

packages/cli/src/services/McpPromptLoader.ts

@@ -158,16 +158,15 @@ export class McpPromptLoader implements ICommandLoader {
               return [];
             }
             const indexOfFirstSpace = invocation.raw.indexOf(' ') + 1;
-            let promptInputs =
+            const parsedInputs =
               indexOfFirstSpace === 0
                 ? {}
                 : this.parseArgs(
                     invocation.raw.substring(indexOfFirstSpace),
                     prompt.arguments,
                   );
-            if (promptInputs instanceof Error) {
-              promptInputs = {};
-            }
+            const promptInputs =
+              parsedInputs instanceof Error ? {} : parsedInputs;
 
             const providedArgNames = Object.keys(promptInputs);
             const unusedArguments =

packages/cli/src/test-utils/render.tsx

@@ -706,13 +706,13 @@ export const renderWithProviders = async (
 
   const terminalWidth = width ?? baseState.terminalWidth;
 
-  if (!config) {
-    config = makeFakeConfig({
+  const finalConfig =
+    config ||
+    makeFakeConfig({
       useAlternateBuffer: settings.merged.ui?.useAlternateBuffer,
       showMemoryUsage: settings.merged.ui?.showMemoryUsage,
       accessibility: settings.merged.ui?.accessibility,
     });
-  }
 
   const mainAreaWidth = providedUiState?.mainAreaWidth ?? terminalWidth;
 
@@ -742,21 +742,23 @@ export const renderWithProviders = async (
 
   const wrapWithProviders = (comp: React.ReactElement) => (
     <AppContext.Provider value={appState}>
-      <ConfigContext.Provider value={config}>
+      <ConfigContext.Provider value={finalConfig}>
         <SettingsContext.Provider value={settings}>
           <QuotaContext.Provider value={quotaState}>
             <InputContext.Provider value={inputState}>
               <UIStateContext.Provider value={finalUiState}>
                 <VimModeProvider>
                   <ShellFocusContext.Provider value={shellFocus}>
-                    <SessionStatsProvider sessionId={config.getSessionId()}>
+                    <SessionStatsProvider
+                      sessionId={finalConfig.getSessionId()}
+                    >
                       <StreamingContext.Provider
                         value={finalUiState.streamingState}
                       >
                         <UIActionsContext.Provider value={finalUIActions}>
                           <OverflowProvider>
                             <ToolActionsProvider
-                              config={config}
+                              config={finalConfig}
                               toolCalls={allToolCalls}
                               isExpanded={
                                 toolActions?.isExpanded ??

packages/cli/src/ui/AppContainer.test.tsx

@@ -491,12 +491,12 @@ describe('AppContainer State Management', () => {
     vi.spyOn(mockConfig, 'initialize').mockResolvedValue(undefined);
     vi.spyOn(mockConfig, 'getDebugMode').mockReturnValue(false);
 
-    mockExtensionManager = vi.mockObject({
+    mockExtensionManager = {
       getExtensions: vi.fn().mockReturnValue([]),
       setRequestConsent: vi.fn(),
       setRequestSetting: vi.fn(),
       start: vi.fn(),
-    } as unknown as ExtensionManager);
+    } as unknown as MockedObject<ExtensionManager>;
     vi.spyOn(mockConfig, 'getExtensionLoader').mockReturnValue(
       mockExtensionManager,
     );

packages/cli/src/ui/auth/AuthDialog.tsx

@@ -83,7 +83,7 @@ export function AuthDialog({
     );
   }
 
-  let defaultAuthType = null;
+  let defaultAuthType: AuthType | null = null;
   const defaultAuthTypeEnv = process.env['GEMINI_DEFAULT_AUTH_TYPE'];
   if (
     defaultAuthTypeEnv &&

packages/cli/src/ui/commands/extensionsCommand.test.ts

@@ -439,7 +439,8 @@ describe('extensionsCommand', () => {
     }
 
     it('should return ExtensionRegistryView custom dialog when experimental.extensionRegistry is true', async () => {
-      mockContext.services.settings.merged.experimental.extensionRegistry = true;
+      mockContext.services.settings.merged.experimental.extensionRegistry =
+        true;
 
       const result = await exploreAction(mockContext, '');
 
@@ -455,7 +456,8 @@ describe('extensionsCommand', () => {
     });
 
     it('should handle onSelect and onClose in ExtensionRegistryView', async () => {
-      mockContext.services.settings.merged.experimental.extensionRegistry = true;
+      mockContext.services.settings.merged.experimental.extensionRegistry =
+        true;
 
       const result = await exploreAction(mockContext, '');
       if (result?.type !== 'custom_dialog') {

packages/cli/src/ui/commands/mcpCommand.ts

@@ -284,7 +284,8 @@ const listAction = async (
     type: MessageType.MCP_STATUS,
     servers: mcpServers,
     tools: mcpTools.map((tool) => ({
-      serverName: tool.serverName,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      serverName: (tool as unknown as { serverName: string }).serverName,
       name: tool.name,
       description: tool.description,
       schema: tool.schema,

packages/cli/src/ui/commands/restoreCommand.ts

@@ -30,7 +30,11 @@ const HistoryItemSchema = z
   })
   .passthrough();
 
-const ToolCallDataSchema = getToolCallDataSchema(HistoryItemSchema);
+/* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+const ToolCallDataSchema = getToolCallDataSchema(
+  HistoryItemSchema as unknown as Parameters<typeof getToolCallDataSchema>[0],
+);
+/* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
 async function restoreAction(
   context: CommandContext,

packages/cli/src/ui/commands/setupGithubCommand.ts

@@ -126,10 +126,13 @@ async function downloadFiles({
         const response = await fetch(endpoint, {
           method: 'GET',
           dispatcher: proxy ? new ProxyAgent(proxy) : undefined,
-          signal: AbortSignal.any([
-            AbortSignal.timeout(30_000),
-            abortController.signal,
-          ]),
+          /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+          signal: (
+            AbortSignal as unknown as {
+              any: (signals: AbortSignal[]) => AbortSignal;
+            }
+          ).any([AbortSignal.timeout(30_000), abortController.signal]),
+          /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
         } as RequestInit);
 
         if (!response.ok) {

packages/cli/src/ui/components/AgentConfigDialog.tsx

@@ -128,7 +128,7 @@ function setNestedValue(obj: unknown, path: string[], value: unknown): unknown {
     if (current[key] === undefined || current[key] === null) {
       current[key] = {};
     } else if (isRecord(current[key])) {
-      current[key] = { ...current[key] };
+      current[key] = { ...(current[key] as object) };
     }
 
     const next = current[key];

packages/cli/src/ui/hooks/atCommandProcessor.test.ts

@@ -1427,7 +1427,8 @@ describe('handleAtCommand', () => {
     const query = `@${filePath}`;
 
     // Simulate user cancellation
-    const mockToolInstance = {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const mockToolInstance: any = {
       buildAndExecute: vi
         .fn()
         .mockRejectedValue(new Error('User cancelled operation')),

packages/cli/src/utils/envVarResolver.ts

@@ -44,8 +44,11 @@ export function resolveEnvVarsInString(
       if (customEnv && typeof customEnv[varName] === 'string') {
         return customEnv[varName];
       }
-      if (process && process.env && typeof process.env[varName] === 'string') {
-        return process.env[varName];
+      if (process && process.env) {
+        const val = process.env[varName];
+        if (typeof val === 'string') {
+          return val;
+        }
       }
       if (defaultValue !== undefined) {
         return defaultValue;

packages/cli/src/utils/gitUtils.ts

@@ -69,7 +69,13 @@ export const getLatestGitHubRelease = async (
         'X-GitHub-Api-Version': '2022-11-28',
       },
       dispatcher: proxy ? new ProxyAgent(proxy) : undefined,
-      signal: AbortSignal.any([AbortSignal.timeout(30_000), controller.signal]),
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      signal: (
+        AbortSignal as unknown as {
+          any: (signals: AbortSignal[]) => AbortSignal;
+        }
+      ).any([AbortSignal.timeout(30_000), controller.signal]),
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
     } as RequestInit);
 
     if (!response.ok) {

packages/cli/src/utils/sandbox.ts

@@ -805,7 +805,7 @@ export async function start_sandbox(
     });
 
     return await new Promise<number>((resolve, reject) => {
-      sandboxProcess.on('error', (err) => {
+      sandboxProcess?.on('error', (err) => {
         coreEvents.emitFeedback('error', 'Sandbox process error', err);
         reject(err);
       });