chore(deps): pin dependencies and enforce 14-day update cooldown (#27948)

packages/core/src/agents/auth-provider/api-key-provider.ts

@@ -22,7 +22,7 @@ const DEFAULT_HEADER_NAME = 'X-API-Key';
  * - A shell command (!command)
  */
 export class ApiKeyAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'apiKey' as const;
+  readonly type = 'apiKey';
 
   private resolvedKey: string | undefined;
   private readonly headerName: string;

packages/core/src/agents/auth-provider/google-credentials-provider.ts

@@ -20,7 +20,7 @@ const ALLOWED_HOSTS = [/^.+\.googleapis\.com$/, CLOUD_RUN_HOST_REGEX];
  * based on the target endpoint URL.
  */
 export class GoogleCredentialsAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'google-credentials' as const;
+  readonly type = 'google-credentials';
 
   private readonly auth: GoogleAuth;
   private readonly useIdToken: boolean = false;

packages/core/src/agents/auth-provider/http-provider.ts

@@ -15,7 +15,7 @@ import { debugLogger } from '../../utils/debugLogger.js';
  * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
  */
 export class HttpAuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'http' as const;
+  readonly type = 'http';
 
   private resolvedToken?: string;
   private resolvedUsername?: string;

packages/core/src/agents/auth-provider/oauth2-provider.ts

@@ -34,7 +34,7 @@ import { Storage } from '../../config/storage.js';
  * and persists tokens via `MCPOAuthTokenStorage`.
  */
 export class OAuth2AuthProvider extends BaseA2AAuthProvider {
-  readonly type = 'oauth2' as const;
+  readonly type = 'oauth2';
 
   private readonly tokenStorage: MCPOAuthTokenStorage;
   private cachedToken: OAuthToken | null = null;

packages/core/src/agents/local-executor.ts

@@ -470,10 +470,13 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
       };
 
       // We monitor both the external signal and our new grace period timeout
-      const combinedSignal = AbortSignal.any([
-        externalSignal,
-        graceTimeoutController.signal,
-      ]);
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      const combinedSignal = (
+        AbortSignal as unknown as {
+          any: (signals: AbortSignal[]) => AbortSignal;
+        }
+      ).any([externalSignal, graceTimeoutController.signal]);
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
       const turnResult = await this.executeTurn(
         chat,
@@ -593,7 +596,11 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
     };
 
     // Combine the external signal with the internal timeout signal.
-    const combinedSignal = AbortSignal.any([signal, deadlineTimer.signal]);
+    /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+    const combinedSignal = (
+      AbortSignal as unknown as { any: (signals: AbortSignal[]) => AbortSignal }
+    ).any([signal, deadlineTimer.signal]);
+    /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
 
     logAgentStart(
       this.context.config,