chore(deps): pin dependencies and enforce 14-day update cooldown (#27948)

packages/core/src/utils/editor.ts

@@ -251,7 +251,8 @@ export function getEditorExtraArgs(
   editor: EditorType,
   options?: { newWindow?: boolean },
 ): string[] {
-  const args = editorExtraArgs[editor] ? [...editorExtraArgs[editor]] : [];
+  const extraArgs = editorExtraArgs[editor];
+  const args = extraArgs ? [...extraArgs] : [];
   if (options?.newWindow && NEW_WINDOW_EDITORS.has(editor)) {
     args.push('--new-window');
   }

packages/core/src/utils/filesearch/ignore.ts

@@ -5,7 +5,10 @@
  */
 
 import fs from 'node:fs';
-import ignore from 'ignore';
+import ignorePkg, { type Ignore as IgnoreType } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => IgnoreType })
+  .default ?? ignorePkg) as () => IgnoreType;
 import picomatch from 'picomatch';
 import type { FileDiscoveryService } from '../../services/fileDiscoveryService.js';
 

packages/core/src/utils/gitIgnoreParser.ts

@@ -6,7 +6,10 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import ignore, { type Ignore } from 'ignore';
+import ignorePkg, { type Ignore } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => Ignore }).default ??
+  ignorePkg) as () => Ignore;
 import { getNormalizedRelativePath } from './ignorePathUtils.js';
 
 export interface GitIgnoreFilter {

packages/core/src/utils/googleQuotaErrors.ts

@@ -177,7 +177,7 @@ function classifyValidationRequiredError(
     // Look for "Learn more" link - identified by description or support.google.com hostname
     const learnMoreLink = helpDetail.links.find((link) => {
       if (link.description.toLowerCase().trim() === 'learn more') return true;
-      const parsed = URL.parse(link.url);
+      const parsed = URL.canParse(link.url) ? new URL(link.url) : null;
       return parsed?.hostname === 'support.google.com';
     });
     if (learnMoreLink) {

packages/core/src/utils/ignoreFileParser.ts

@@ -6,7 +6,10 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import ignore from 'ignore';
+import ignorePkg, { type Ignore } from 'ignore';
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+const ignore = ((ignorePkg as unknown as { default?: () => Ignore }).default ??
+  ignorePkg) as () => Ignore;
 import { debugLogger } from './debugLogger.js';
 import { getNormalizedRelativePath } from './ignorePathUtils.js';
 

packages/core/src/utils/llm-edit-fixer.ts

@@ -103,10 +103,16 @@ async function generateJsonWithTimeout<T>(
       ...params,
       // The operation will be aborted if either the original signal is aborted
       // or if the timeout is reached.
-      abortSignal: AbortSignal.any([
+      /* eslint-disable @typescript-eslint/no-unsafe-type-assertion */
+      abortSignal: (
+        AbortSignal as unknown as {
+          any: (signals: Array<AbortSignal | undefined>) => AbortSignal;
+        }
+      ).any([
         params.abortSignal ?? new AbortController().signal,
         timeoutSignal,
       ]),
+      /* eslint-enable @typescript-eslint/no-unsafe-type-assertion */
     });
     // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
     return result as T;

packages/core/src/utils/schemaValidator.ts

@@ -8,7 +8,7 @@ import AjvPkg, { type AnySchema, type Ajv } from 'ajv';
 // Ajv2020 is the documented way to use draft-2020-12: https://ajv.js.org/json-schema.html#draft-2020-12
 
 import Ajv2020Pkg from 'ajv/dist/2020.js';
-import * as addFormats from 'ajv-formats';
+import addFormats from 'ajv-formats';
 import { debugLogger } from './debugLogger.js';
 
 // Ajv's ESM/CJS interop: use 'any' for compatibility as recommended by Ajv docs
@@ -36,10 +36,11 @@ const ajvDefault: Ajv = new AjvClass(ajvOptions);
 // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const ajv2020: Ajv = new Ajv2020Class(ajvOptions);
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-unsafe-assignment
-const addFormatsFunc = (addFormats as any).default || addFormats;
-addFormatsFunc(ajvDefault);
-addFormatsFunc(ajv2020);
+const addFormatsFunc = addFormats.default || addFormats;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
+addFormatsFunc(ajvDefault as any);
+// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-type-assertion
+addFormatsFunc(ajv2020 as any);
 
 // Canonical draft-2020-12 meta-schema URI (used by rmcp MCP servers)
 const DRAFT_2020_12_SCHEMA = 'https://json-schema.org/draft/2020-12/schema';