chore(deps): pin dependencies and enforce 14-day update cooldown (#27948)

packages/core/package.json

@@ -24,95 +24,95 @@
   ],
   "dependencies": {
     "@a2a-js/sdk": "0.3.11",
-    "@bufbuild/protobuf": "^2.11.0",
-    "@google-cloud/logging": "^11.2.1",
-    "@google-cloud/opentelemetry-cloud-monitoring-exporter": "^0.21.0",
-    "@google-cloud/opentelemetry-cloud-trace-exporter": "^3.0.0",
+    "@bufbuild/protobuf": "2.11.0",
+    "@google-cloud/logging": "11.2.1",
+    "@google-cloud/opentelemetry-cloud-monitoring-exporter": "0.21.0",
+    "@google-cloud/opentelemetry-cloud-trace-exporter": "3.0.0",
     "@google/genai": "1.30.0",
-    "@grpc/grpc-js": "^1.14.3",
-    "@iarna/toml": "^2.2.5",
-    "@modelcontextprotocol/sdk": "^1.23.0",
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/api-logs": "^0.218.0",
-    "@opentelemetry/core": "^2.7.1",
-    "@opentelemetry/exporter-logs-otlp-grpc": "^0.218.0",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.218.0",
-    "@opentelemetry/exporter-metrics-otlp-grpc": "^0.218.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
-    "@opentelemetry/exporter-trace-otlp-grpc": "^0.218.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
-    "@opentelemetry/instrumentation-http": "^0.218.0",
-    "@opentelemetry/otlp-exporter-base": "^0.218.0",
-    "@opentelemetry/resources": "^2.7.1",
-    "@opentelemetry/sdk-logs": "^0.218.0",
-    "@opentelemetry/sdk-metrics": "^2.7.1",
-    "@opentelemetry/sdk-node": "^0.218.0",
-    "@opentelemetry/sdk-trace-base": "^2.7.1",
-    "@opentelemetry/sdk-trace-node": "^2.7.1",
-    "@opentelemetry/semantic-conventions": "^1.39.0",
-    "@types/html-to-text": "^9.0.4",
+    "@grpc/grpc-js": "1.14.3",
+    "@iarna/toml": "2.2.5",
+    "@modelcontextprotocol/sdk": "1.23.0",
+    "@opentelemetry/api": "1.9.0",
+    "@opentelemetry/api-logs": "0.218.0",
+    "@opentelemetry/core": "2.7.1",
+    "@opentelemetry/exporter-logs-otlp-grpc": "0.218.0",
+    "@opentelemetry/exporter-logs-otlp-http": "0.218.0",
+    "@opentelemetry/exporter-metrics-otlp-grpc": "0.218.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.218.0",
+    "@opentelemetry/exporter-trace-otlp-grpc": "0.218.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.218.0",
+    "@opentelemetry/instrumentation-http": "0.218.0",
+    "@opentelemetry/otlp-exporter-base": "0.218.0",
+    "@opentelemetry/resources": "2.7.1",
+    "@opentelemetry/sdk-logs": "0.218.0",
+    "@opentelemetry/sdk-metrics": "2.7.1",
+    "@opentelemetry/sdk-node": "0.218.0",
+    "@opentelemetry/sdk-trace-base": "2.7.1",
+    "@opentelemetry/sdk-trace-node": "2.7.1",
+    "@opentelemetry/semantic-conventions": "1.39.0",
+    "@types/html-to-text": "9.0.4",
     "@xterm/headless": "5.5.0",
-    "ajv": "^8.17.1",
-    "ajv-formats": "^3.0.0",
-    "chokidar": "^5.0.0",
-    "command-exists": "^1.2.9",
-    "diff": "^8.0.3",
-    "dotenv": "^17.2.4",
-    "dotenv-expand": "^12.0.3",
-    "execa": "^9.6.1",
-    "fast-levenshtein": "^2.0.6",
-    "fdir": "^6.4.6",
-    "fzf": "^0.5.2",
-    "glob": "^12.0.0",
-    "google-auth-library": "^9.11.0",
-    "html-to-text": "^9.0.5",
-    "http-proxy-agent": "^7.0.2",
-    "https-proxy-agent": "^7.0.6",
-    "ignore": "^7.0.0",
-    "ipaddr.js": "^1.9.1",
-    "isbinaryfile": "^5.0.7",
-    "js-yaml": "^4.1.1",
-    "json-stable-stringify": "^1.3.0",
-    "marked": "^15.0.12",
+    "ajv": "8.17.1",
+    "ajv-formats": "3.0.1",
+    "chokidar": "5.0.0",
+    "command-exists": "1.2.9",
+    "diff": "8.0.3",
+    "dotenv": "17.2.4",
+    "dotenv-expand": "12.0.3",
+    "execa": "9.6.1",
+    "fast-levenshtein": "2.0.6",
+    "fdir": "6.4.6",
+    "fzf": "0.5.2",
+    "glob": "12.0.0",
+    "google-auth-library": "9.11.0",
+    "html-to-text": "9.0.5",
+    "http-proxy-agent": "7.0.2",
+    "https-proxy-agent": "7.0.6",
+    "ignore": "7.0.0",
+    "ipaddr.js": "1.9.1",
+    "isbinaryfile": "5.0.7",
+    "js-yaml": "4.1.1",
+    "json-stable-stringify": "1.3.0",
+    "marked": "15.0.12",
     "mime": "4.0.7",
-    "mnemonist": "^0.40.3",
-    "open": "^10.1.2",
-    "picomatch": "^4.0.1",
-    "proper-lockfile": "^4.1.2",
-    "puppeteer-core": "^24.0.0",
-    "read-package-up": "^11.0.0",
-    "shell-quote": "^1.8.3",
-    "simple-git": "^3.28.0",
-    "strip-ansi": "^7.1.0",
-    "strip-json-comments": "^3.1.1",
-    "systeminformation": "^5.25.11",
-    "tree-sitter-bash": "^0.25.0",
-    "undici": "^7.10.0",
-    "uuid": "^13.0.0",
-    "web-tree-sitter": "^0.25.10",
-    "zod": "^3.25.76",
-    "zod-to-json-schema": "^3.25.1"
+    "mnemonist": "0.40.3",
+    "open": "10.1.2",
+    "picomatch": "4.0.1",
+    "proper-lockfile": "4.1.2",
+    "puppeteer-core": "24.0.0",
+    "read-package-up": "11.0.0",
+    "shell-quote": "1.8.3",
+    "simple-git": "3.28.0",
+    "strip-ansi": "7.1.0",
+    "strip-json-comments": "3.1.1",
+    "systeminformation": "5.25.11",
+    "tree-sitter-bash": "0.25.0",
+    "undici": "7.10.0",
+    "uuid": "13.0.0",
+    "web-tree-sitter": "0.25.10",
+    "zod": "3.25.76",
+    "zod-to-json-schema": "3.25.1"
   },
   "optionalDependencies": {
-    "@github/keytar": "^7.10.6",
+    "@github/keytar": "7.10.6",
     "@lydell/node-pty": "1.1.0",
     "@lydell/node-pty-darwin-arm64": "1.1.0",
     "@lydell/node-pty-darwin-x64": "1.1.0",
     "@lydell/node-pty-linux-x64": "1.1.0",
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
-    "node-pty": "^1.0.0"
+    "node-pty": "1.0.0"
   },
   "devDependencies": {
     "@google/gemini-cli-test-utils": "file:../test-utils",
-    "@types/fast-levenshtein": "^0.0.4",
-    "@types/js-yaml": "^4.0.9",
-    "@types/json-stable-stringify": "^1.1.0",
-    "@types/picomatch": "^4.0.1",
-    "chrome-devtools-mcp": "^0.19.0",
-    "msw": "^2.3.4",
-    "typescript": "^5.3.3",
-    "vitest": "^3.1.1"
+    "@types/fast-levenshtein": "0.0.4",
+    "@types/js-yaml": "4.0.9",
+    "@types/json-stable-stringify": "1.1.0",
+    "@types/picomatch": "4.0.1",
+    "chrome-devtools-mcp": "0.19.0",
+    "msw": "2.3.4",
+    "typescript": "5.8.3",
+    "vitest": "3.2.4"
   },
   "engines": {
     "node": ">=20"

packages/core/src/agents/auth-provider/api-key-provider.ts

@@ -22,7 +22,7 @@ const DEFAULT_HEADER_NAME = 'X-API-Key';
  * - A shell command (!command)
  */
 export class ApiKeyAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'apiKey' as const;
+  readonly type = 'apiKey';
 
   private resolvedKey: string | undefined;
   private readonly headerName: string;

packages/core/src/agents/auth-provider/google-credentials-provider.ts

@@ -20,7 +20,7 @@ const ALLOWED_HOSTS = [/^.+\.googleapis\.com$/, CLOUD_RUN_HOST_REGEX];
  * based on the target endpoint URL.
  */
 export class GoogleCredentialsAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'google-credentials' as const;
+  readonly type = 'google-credentials';
 
   private readonly auth: GoogleAuth;
   private readonly useIdToken: boolean = false;

packages/core/src/agents/auth-provider/http-provider.ts

@@ -15,7 +15,7 @@ import { debugLogger } from '../../utils/debugLogger.js';
  * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
  */
 export class HttpAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'http' as const;
+  readonly type = 'http';
 
   private resolvedToken?: string;
   private resolvedUsername?: string;

packages/core/src/agents/auth-provider/oauth2-provider.ts

@@ -34,7 +34,7 @@ import { Storage } from '../../config/storage.js';
  * and persists tokens via `MCPOAuthTokenStorage`.
  */
 export class OAuth2AuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'oauth2' as const;
+  readonly type = 'oauth2';
 
   private readonly tokenStorage: MCPOAuthTokenStorage;
   private cachedToken: OAuthToken | null = null;

packages/core/src/agents/local-executor.ts

@@ -470,10 +470,13 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
       };
 
       // We monitor both the external signal and our new grace period timeout
-      const combinedSignal = AbortSignal.any([
-        externalSignal,
-        graceTimeoutController.signal,
-      ]);
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      const combinedSignal = (
+        AbortSignal as unknown as {
+          any: (signals: AbortSignal[]) => AbortSignal;
+        }
+      ).any([externalSignal, graceTimeoutController.signal]);
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
       const turnResult = await this.executeTurn(
         chat,
@@ -593,7 +596,11 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
     };
 
     // Combine the external signal with the internal timeout signal.
-    const combinedSignal = AbortSignal.any([signal, deadlineTimer.signal]);
+    /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+    const combinedSignal = (
+      AbortSignal as unknown as { any: (signals: AbortSignal[]) => AbortSignal }
+    ).any([signal, deadlineTimer.signal]);
+    /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
     logAgentStart(
       this.context.config,

packages/core/src/ide/ide-client.ts

@@ -251,8 +251,11 @@ export class IdeClient {
             const textPart = parsedResultData.content.find(
               (part) => part.type === 'text',
             );
+
             const errorMessage =
-              textPart?.text ?? `Tool 'openDiff' reported an error.`;
+              // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+              (textPart as { text?: string })?.text ??
+              `Tool 'openDiff' reported an error.`;
             logger.debug(
               `Request for openDiff ${filePath} failed with isError:`,
               errorMessage,
@@ -332,7 +335,7 @@ export class IdeClient {
       if (resultData.isError) {
         const textPart = resultData.content.find(
           (part) => part.type === 'text',
-        );
+        ) as { type: 'text'; text: string } | undefined;
         const errorMessage =
           textPart?.text ?? `Tool 'closeDiff' reported an error.`;
         logger.debug(
@@ -342,7 +345,9 @@ export class IdeClient {
         return undefined;
       }
 
-      const textPart = resultData.content.find((part) => part.type === 'text');
+      const textPart = resultData.content.find(
+        (part): part is { type: 'text'; text: string } => part.type === 'text',
+      );
 
       if (textPart?.text) {
         try {

packages/core/src/policy/toml-loader.ts

@@ -732,7 +732,7 @@ export function validateMcpPolicyToolNames(
     if (discoveredToolNames.length === 0) continue;
 
     const minDistance = Math.min(
-      ...discoveredToolNames.map((n) => levenshtein.get(toolPart, n)),
+      ...discoveredToolNames.map((n) => levenshtein.get(toolPart ?? '', n)),
     );
 
     if (minDistance > MAX_TYPO_DISTANCE) continue;

packages/core/src/services/executionLifecycleService.ts

@@ -445,12 +445,10 @@ export class ExecutionLifecycleService {
       return;
     }
 
-    const {
-      error = null,
-      aborted = false,
-      exitCode = error ? 1 : 0,
-      signal = null,
-    } = options ?? {};
+    const error = options?.error ?? null;
+    const aborted = options?.aborted ?? false;
+    const exitCode = options?.exitCode ?? (error ? 1 : 0);
+    const signal = options?.signal ?? null;
 
     const output = execution.getBackgroundOutput?.() ?? execution.output;
     const snapshot = execution.getSubscriptionSnapshot?.();

packages/core/src/telemetry/clearcut-logger/clearcut-logger.test.ts

@@ -69,7 +69,7 @@ interface CustomMatchers<R = unknown> {
 
 declare module 'vitest' {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-empty-object-type
-  interface Matchers<T = any> extends CustomMatchers<T> {}
+  interface Assertion<T = any> extends CustomMatchers<T> {}
 }
 
 expect.extend({
@@ -929,15 +929,13 @@ describe('ClearcutLogger', () => {
       const { logger } = setup();
 
       server.resetHandlers(
-        http.post(
-          CLEARCUT_URL,
-          () =>
-            new HttpResponse(
-              { 'the system is down': true },
-              {
-                status: 500,
-              },
-            ),
+        http.post(CLEARCUT_URL, () =>
+          HttpResponse.json(
+            { 'the system is down': true },
+            {
+              status: 500,
+            },
+          ),
         ),
       );
 

packages/core/src/tools/mcp-client-manager.test.ts

@@ -35,16 +35,16 @@ describe('McpClientManager', () => {
   let toolRegistry: ToolRegistry;
 
   beforeEach(() => {
-    mockedMcpClient = vi.mockObject({
+    mockedMcpClient = {
       connect: vi.fn(),
       discoverInto: vi.fn(),
       disconnect: vi.fn(),
       getStatus: vi.fn().mockReturnValue(MCPServerStatus.DISCONNECTED),
       getServerConfig: vi.fn(),
       getServerName: vi.fn().mockReturnValue('test-server'),
-    } as unknown as McpClient);
+    } as unknown as MockedObject<McpClient>;
     vi.mocked(McpClient).mockReturnValue(mockedMcpClient);
-    mockConfig = vi.mockObject({
+    mockConfig = {
       isTrustedFolder: vi.fn().mockReturnValue(true),
       getMcpServers: vi.fn().mockReturnValue({}),
       getPromptRegistry: vi.fn().mockReturnValue({ registerPrompt: vi.fn() }),
@@ -62,15 +62,15 @@ describe('McpClientManager', () => {
         isInitialized: vi.fn(),
       }),
       refreshMcpContext: vi.fn(),
-    } as unknown as Config);
-    toolRegistry = vi.mockObject({
+    } as unknown as MockedObject<Config>;
+    toolRegistry = {
       registerTool: vi.fn(),
       unregisterTool: vi.fn(),
       sortTools: vi.fn(),
       getMessageBus: vi.fn().mockReturnValue({}),
       removeMcpToolsByServer: vi.fn(),
       getToolsByServer: vi.fn().mockReturnValue([]),
-    } as unknown as ToolRegistry);
+    } as unknown as ToolRegistry;
   });
 
   afterEach(() => {

packages/core/src/tools/mcp-client.ts

@@ -1148,10 +1148,12 @@ class LenientJsonSchemaValidator implements jsonSchemaValidator {
     try {
       return this.ajvValidator.getValidator<T>(schema);
     } catch (error) {
+      let id = '<no $id>';
+      if (schema && typeof schema === 'object' && '$id' in schema) {
+        id = String(schema.$id);
+      }
       debugLogger.warn(
-        `Failed to compile MCP tool output schema (${
-          (schema as Record<string, unknown>)?.['$id'] ?? '<no $id>'
-        }): ${error instanceof Error ? error.message : String(error)}. ` +
+        `Failed to compile MCP tool output schema (${id}): ${error instanceof Error ? error.message : String(error)}. ` +
           'Skipping output validation for this tool.',
       );
       return (input: unknown) => ({

packages/core/src/tools/tool-registry.ts

@@ -634,7 +634,7 @@ export class ToolRegistry {
         possibleNames.push(`${tool.getFullyQualifiedPrefix()}${tool.name}`);
       }
     }
-    return !possibleNames.some((name) => excludeTools.has(name));
+    return !possibleNames.some((name) => excludeTools?.has(name));
   }
 
   /**

packages/core/src/utils/editor.ts

@@ -251,7 +251,8 @@ export function getEditorExtraArgs(
   editor: EditorType,
   options?: { newWindow?: boolean },
 ): string[] {
-  const args = editorExtraArgs[editor] ? [...editorExtraArgs[editor]] : [];
+  const extraArgs = editorExtraArgs[editor];
+  const args = extraArgs ? [...extraArgs] : [];
   if (options?.newWindow && NEW_WINDOW_EDITORS.has(editor)) {
     args.push('--new-window');
   }

packages/core/src/utils/filesearch/ignore.ts

@@ -5,7 +5,10 @@
  */
 
 import fs from 'node:fs';
-import ignore from 'ignore';
+import ignorePkg, { type Ignore as IgnoreType } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => IgnoreType })
+  .default ?? ignorePkg) as () => IgnoreType;
 import picomatch from 'picomatch';
 import type { FileDiscoveryService } from '../../services/fileDiscoveryService.js';
 

packages/core/src/utils/gitIgnoreParser.ts

@@ -6,7 +6,10 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import ignore, { type Ignore } from 'ignore';
+import ignorePkg, { type Ignore } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => Ignore }).default ??
+  ignorePkg) as () => Ignore;
 import { getNormalizedRelativePath } from './ignorePathUtils.js';
 
 export interface GitIgnoreFilter {

packages/core/src/utils/googleQuotaErrors.ts

@@ -177,7 +177,7 @@ function classifyValidationRequiredError(
     // Look for "Learn more" link - identified by description or support.google.com hostname
     const learnMoreLink = helpDetail.links.find((link) => {
       if (link.description.toLowerCase().trim() === 'learn more') return true;
-      const parsed = URL.parse(link.url);
+      const parsed = URL.canParse(link.url) ? new URL(link.url) : null;
       return parsed?.hostname === 'support.google.com';
     });
     if (learnMoreLink) {

packages/core/src/utils/ignoreFileParser.ts

@@ -6,7 +6,10 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import ignore from 'ignore';
+import ignorePkg, { type Ignore } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => Ignore }).default ??
+  ignorePkg) as () => Ignore;
 import { debugLogger } from './debugLogger.js';
 import { getNormalizedRelativePath } from './ignorePathUtils.js';
 

packages/core/src/utils/llm-edit-fixer.ts

@@ -103,10 +103,16 @@ async function generateJsonWithTimeout<T>(
       ...params,
       // The operation will be aborted if either the original signal is aborted
       // or if the timeout is reached.
-      abortSignal: AbortSignal.any([
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      abortSignal: (
+        AbortSignal as unknown as {
+          any: (signals: Array<AbortSignal | undefined>) => AbortSignal;
+        }
+      ).any([
         params.abortSignal ?? new AbortController().signal,
         timeoutSignal,
       ]),
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
     });
     // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return result as T;

packages/core/src/utils/schemaValidator.ts

@@ -8,7 +8,7 @@ import AjvPkg, { type AnySchema, type Ajv } from 'ajv';
 // Ajv2020 is the documented way to use draft-2020-12: https://ajv.js.org/json-schema.html#draft-2020-12
 
 import Ajv2020Pkg from 'ajv/dist/2020.js';
-import * as addFormats from 'ajv-formats';
+import addFormats from 'ajv-formats';
 import { debugLogger } from './debugLogger.js';
 
 // Ajv's ESM/CJS interop: use 'any' for compatibility as recommended by Ajv docs
@@ -36,10 +36,11 @@ const ajvDefault: Ajv = new AjvClass(ajvOptions);
 // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const ajv2020: Ajv = new Ajv2020Class(ajvOptions);
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-unsafe-assignment
-const addFormatsFunc = (addFormats as any).default || addFormats;
-addFormatsFunc(ajvDefault);
-addFormatsFunc(ajv2020);
+const addFormatsFunc = addFormats.default || addFormats;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
+addFormatsFunc(ajvDefault as any);
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
+addFormatsFunc(ajv2020 as any);
 
 // Canonical draft-2020-12 meta-schema URI (used by rmcp MCP servers)
 const DRAFT_2020_12_SCHEMA = 'https://json-schema.org/draft/2020-12/schema';