chore(deps): pin dependencies and enforce 14-day update cooldown (#27948)

packages/core/src/agents/auth-provider/api-key-provider.ts

@@ -22,7 +22,7 @@ const DEFAULT_HEADER_NAME = 'X-API-Key';
  * - A shell command (!command)
  */
 export class ApiKeyAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'apiKey' as const;
+  readonly type = 'apiKey';
 
   private resolvedKey: string | undefined;
   private readonly headerName: string;

packages/core/src/agents/auth-provider/google-credentials-provider.ts

@@ -20,7 +20,7 @@ const ALLOWED_HOSTS = [/^.+\.googleapis\.com$/, CLOUD_RUN_HOST_REGEX];
  * based on the target endpoint URL.
  */
 export class GoogleCredentialsAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'google-credentials' as const;
+  readonly type = 'google-credentials';
 
   private readonly auth: GoogleAuth;
   private readonly useIdToken: boolean = false;

packages/core/src/agents/auth-provider/http-provider.ts

@@ -15,7 +15,7 @@ import { debugLogger } from '../../utils/debugLogger.js';
  * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
  */
 export class HttpAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'http' as const;
+  readonly type = 'http';
 
   private resolvedToken?: string;
   private resolvedUsername?: string;

packages/core/src/agents/auth-provider/oauth2-provider.ts

@@ -34,7 +34,7 @@ import { Storage } from '../../config/storage.js';
  * and persists tokens via `MCPOAuthTokenStorage`.
  */
 export class OAuth2AuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'oauth2' as const;
+  readonly type = 'oauth2';
 
   private readonly tokenStorage: MCPOAuthTokenStorage;
   private cachedToken: OAuthToken | null = null;

packages/core/src/agents/local-executor.ts

@@ -470,10 +470,13 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
       };
 
       // We monitor both the external signal and our new grace period timeout
-      const combinedSignal = AbortSignal.any([
-        externalSignal,
-        graceTimeoutController.signal,
-      ]);
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      const combinedSignal = (
+        AbortSignal as unknown as {
+          any: (signals: AbortSignal[]) => AbortSignal;
+        }
+      ).any([externalSignal, graceTimeoutController.signal]);
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
       const turnResult = await this.executeTurn(
         chat,
@@ -593,7 +596,11 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
     };
 
     // Combine the external signal with the internal timeout signal.
-    const combinedSignal = AbortSignal.any([signal, deadlineTimer.signal]);
+    /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+    const combinedSignal = (
+      AbortSignal as unknown as { any: (signals: AbortSignal[]) => AbortSignal }
+    ).any([signal, deadlineTimer.signal]);
+    /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
     logAgentStart(
       this.context.config,

packages/core/src/ide/ide-client.ts

@@ -251,8 +251,11 @@ export class IdeClient {
             const textPart = parsedResultData.content.find(
               (part) => part.type === 'text',
             );
+
             const errorMessage =
-              textPart?.text ?? `Tool 'openDiff' reported an error.`;
+              // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+              (textPart as { text?: string })?.text ??
+              `Tool 'openDiff' reported an error.`;
             logger.debug(
               `Request for openDiff ${filePath} failed with isError:`,
               errorMessage,
@@ -332,7 +335,7 @@ export class IdeClient {
       if (resultData.isError) {
         const textPart = resultData.content.find(
           (part) => part.type === 'text',
-        );
+        ) as { type: 'text'; text: string } | undefined;
         const errorMessage =
           textPart?.text ?? `Tool 'closeDiff' reported an error.`;
         logger.debug(
@@ -342,7 +345,9 @@ export class IdeClient {
         return undefined;
       }
 
-      const textPart = resultData.content.find((part) => part.type === 'text');
+      const textPart = resultData.content.find(
+        (part): part is { type: 'text'; text: string } => part.type === 'text',
+      );
 
       if (textPart?.text) {
         try {

packages/core/src/policy/toml-loader.ts

@@ -732,7 +732,7 @@ export function validateMcpPolicyToolNames(
     if (discoveredToolNames.length === 0) continue;
 
     const minDistance = Math.min(
-      ...discoveredToolNames.map((n) => levenshtein.get(toolPart, n)),
+      ...discoveredToolNames.map((n) => levenshtein.get(toolPart ?? '', n)),
     );
 
     if (minDistance > MAX_TYPO_DISTANCE) continue;

packages/core/src/services/executionLifecycleService.ts

@@ -445,12 +445,10 @@ export class ExecutionLifecycleService {
       return;
     }
 
-    const {
-      error = null,
-      aborted = false,
-      exitCode = error ? 1 : 0,
-      signal = null,
-    } = options ?? {};
+    const error = options?.error ?? null;
+    const aborted = options?.aborted ?? false;
+    const exitCode = options?.exitCode ?? (error ? 1 : 0);
+    const signal = options?.signal ?? null;
 
     const output = execution.getBackgroundOutput?.() ?? execution.output;
     const snapshot = execution.getSubscriptionSnapshot?.();

packages/core/src/telemetry/clearcut-logger/clearcut-logger.test.ts

@@ -69,7 +69,7 @@ interface CustomMatchers<R = unknown> {
 
 declare module 'vitest' {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-empty-object-type
-  interface Matchers<T = any> extends CustomMatchers<T> {}
+  interface Assertion<T = any> extends CustomMatchers<T> {}
 }
 
 expect.extend({
@@ -929,15 +929,13 @@ describe('ClearcutLogger', () => {
       const { logger } = setup();
 
       server.resetHandlers(
-        http.post(
-          CLEARCUT_URL,
-          () =>
-            new HttpResponse(
-              { 'the system is down': true },
-              {
-                status: 500,
-              },
-            ),
+        http.post(CLEARCUT_URL, () =>
+          HttpResponse.json(
+            { 'the system is down': true },
+            {
+              status: 500,
+            },
+          ),
         ),
       );
 

packages/core/src/tools/mcp-client-manager.test.ts

@@ -35,16 +35,16 @@ describe('McpClientManager', () => {
   let toolRegistry: ToolRegistry;
 
   beforeEach(() => {
-    mockedMcpClient = vi.mockObject({
+    mockedMcpClient = {
       connect: vi.fn(),
       discoverInto: vi.fn(),
       disconnect: vi.fn(),
       getStatus: vi.fn().mockReturnValue(MCPServerStatus.DISCONNECTED),
       getServerConfig: vi.fn(),
       getServerName: vi.fn().mockReturnValue('test-server'),
-    } as unknown as McpClient);
+    } as unknown as MockedObject<McpClient>;
     vi.mocked(McpClient).mockReturnValue(mockedMcpClient);
-    mockConfig = vi.mockObject({
+    mockConfig = {
       isTrustedFolder: vi.fn().mockReturnValue(true),
       getMcpServers: vi.fn().mockReturnValue({}),
       getPromptRegistry: vi.fn().mockReturnValue({ registerPrompt: vi.fn() }),
@@ -62,15 +62,15 @@ describe('McpClientManager', () => {
         isInitialized: vi.fn(),
       }),
       refreshMcpContext: vi.fn(),
-    } as unknown as Config);
-    toolRegistry = vi.mockObject({
+    } as unknown as MockedObject<Config>;
+    toolRegistry = {
       registerTool: vi.fn(),
       unregisterTool: vi.fn(),
       sortTools: vi.fn(),
       getMessageBus: vi.fn().mockReturnValue({}),
       removeMcpToolsByServer: vi.fn(),
       getToolsByServer: vi.fn().mockReturnValue([]),
-    } as unknown as ToolRegistry);
+    } as unknown as ToolRegistry;
   });
 
   afterEach(() => {

packages/core/src/tools/mcp-client.ts

@@ -1148,10 +1148,12 @@ class LenientJsonSchemaValidator implements jsonSchemaValidator {
     try {
       return this.ajvValidator.getValidator<T>(schema);
     } catch (error) {
+      let id = '<no $id>';
+      if (schema && typeof schema === 'object' && '$id' in schema) {
+        id = String(schema.$id);
+      }
       debugLogger.warn(
-        `Failed to compile MCP tool output schema (${
-          (schema as Record<string, unknown>)?.['$id'] ?? '<no $id>'
-        }): ${error instanceof Error ? error.message : String(error)}. ` +
+        `Failed to compile MCP tool output schema (${id}): ${error instanceof Error ? error.message : String(error)}. ` +
           'Skipping output validation for this tool.',
       );
       return (input: unknown) => ({

packages/core/src/tools/tool-registry.ts

@@ -634,7 +634,7 @@ export class ToolRegistry {
         possibleNames.push(`${tool.getFullyQualifiedPrefix()}${tool.name}`);
       }
     }
-    return !possibleNames.some((name) => excludeTools.has(name));
+    return !possibleNames.some((name) => excludeTools?.has(name));
   }
 
   /**

packages/core/src/utils/editor.ts

@@ -251,7 +251,8 @@ export function getEditorExtraArgs(
   editor: EditorType,
   options?: { newWindow?: boolean },
 ): string[] {
-  const args = editorExtraArgs[editor] ? [...editorExtraArgs[editor]] : [];
+  const extraArgs = editorExtraArgs[editor];
+  const args = extraArgs ? [...extraArgs] : [];
   if (options?.newWindow && NEW_WINDOW_EDITORS.has(editor)) {
     args.push('--new-window');
   }

packages/core/src/utils/filesearch/ignore.ts

@@ -5,7 +5,10 @@
  */
 
 import fs from 'node:fs';
-import ignore from 'ignore';
+import ignorePkg, { type Ignore as IgnoreType } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => IgnoreType })
+  .default ?? ignorePkg) as () => IgnoreType;
 import picomatch from 'picomatch';
 import type { FileDiscoveryService } from '../../services/fileDiscoveryService.js';
 

packages/core/src/utils/gitIgnoreParser.ts

@@ -6,7 +6,10 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import ignore, { type Ignore } from 'ignore';
+import ignorePkg, { type Ignore } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => Ignore }).default ??
+  ignorePkg) as () => Ignore;
 import { getNormalizedRelativePath } from './ignorePathUtils.js';
 
 export interface GitIgnoreFilter {

packages/core/src/utils/googleQuotaErrors.ts

@@ -177,7 +177,7 @@ function classifyValidationRequiredError(
     // Look for "Learn more" link - identified by description or support.google.com hostname
     const learnMoreLink = helpDetail.links.find((link) => {
       if (link.description.toLowerCase().trim() === 'learn more') return true;
-      const parsed = URL.parse(link.url);
+      const parsed = URL.canParse(link.url) ? new URL(link.url) : null;
       return parsed?.hostname === 'support.google.com';
     });
     if (learnMoreLink) {

packages/core/src/utils/ignoreFileParser.ts

@@ -6,7 +6,10 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import ignore from 'ignore';
+import ignorePkg, { type Ignore } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => Ignore }).default ??
+  ignorePkg) as () => Ignore;
 import { debugLogger } from './debugLogger.js';
 import { getNormalizedRelativePath } from './ignorePathUtils.js';
 

packages/core/src/utils/llm-edit-fixer.ts

@@ -103,10 +103,16 @@ async function generateJsonWithTimeout<T>(
       ...params,
       // The operation will be aborted if either the original signal is aborted
       // or if the timeout is reached.
-      abortSignal: AbortSignal.any([
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      abortSignal: (
+        AbortSignal as unknown as {
+          any: (signals: Array<AbortSignal | undefined>) => AbortSignal;
+        }
+      ).any([
         params.abortSignal ?? new AbortController().signal,
         timeoutSignal,
       ]),
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
     });
     // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return result as T;

packages/core/src/utils/schemaValidator.ts

@@ -8,7 +8,7 @@ import AjvPkg, { type AnySchema, type Ajv } from 'ajv';
 // Ajv2020 is the documented way to use draft-2020-12: https://ajv.js.org/json-schema.html#draft-2020-12
 
 import Ajv2020Pkg from 'ajv/dist/2020.js';
-import * as addFormats from 'ajv-formats';
+import addFormats from 'ajv-formats';
 import { debugLogger } from './debugLogger.js';
 
 // Ajv's ESM/CJS interop: use 'any' for compatibility as recommended by Ajv docs
@@ -36,10 +36,11 @@ const ajvDefault: Ajv = new AjvClass(ajvOptions);
 // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const ajv2020: Ajv = new Ajv2020Class(ajvOptions);
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-unsafe-assignment
-const addFormatsFunc = (addFormats as any).default || addFormats;
-addFormatsFunc(ajvDefault);
-addFormatsFunc(ajv2020);
+const addFormatsFunc = addFormats.default || addFormats;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
+addFormatsFunc(ajvDefault as any);
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
+addFormatsFunc(ajv2020 as any);
 
 // Canonical draft-2020-12 meta-schema URI (used by rmcp MCP servers)
 const DRAFT_2020_12_SCHEMA = 'https://json-schema.org/draft/2020-12/schema';