chore(deps): bump the third-party group across 3 directories with 19 updates

[dependabot]

Summary

Update the grouped third-party dependencies and fix the compatibility failures exposed by the upgrades. Keep the CLI's existing read-only MCP interface and the shared Codex version pin.

Changes

• Retain the dependency upgrades across the SDK, MCP app, and triage evals.
• Explicitly use direct MCP tool discovery after Incur changed its default.
• Remove the obsolete MCP declaration shim and use the SDK's shipped types for tool results and immediate Deep Scan responses.
• Regenerate models and apply the formatting required by Prettier 3.9.6.
• Remove a duplicate test that extracted a generated function by name; existing coordinator and stdio restart tests cover that behavior without depending on esbuild's generated names.
• Bind the OpenCode override to its direct dependency and keep transitive Codex executables on the existing SDK pin. Document the eval runner's Node.js 22.22.0 minimum.

Testing

Passed locally:

• All five portable source checks: Ruff check, Ruff format check, SDK build:ci, plugin source compatibility, and its 9 Node tests.
• SDK types, format, build, example build, package creation, and archive checks (488 entries), including the TypeScript 7 upgrades merged from main.
• Frozen SDK and MCP dependency installs with the compiler, Node type, and grouped dependency upgrades preserved from main.
• Focused CLI/runtime/package-contract Bun tests: 322 passed, 22 skipped.
• Full SDK suites with seed 12345 and randomized seed 1883891742: 2,994 passed, 50 platform skips, zero failures in each run. These completed before the final Node-type sync from main.
• After the final Node-type sync: repeated source, type, formatting, build, package, and runtime checks; the affected runtime suite passed 154 tests with 22 platform skips.
• Deterministic triage eval harness tests.
• MCP tests: all 23 test files covered, including a successful isolated smoke rerun.

The GitHub CI matrix passed on both preceding integration heads (42 successful jobs each), including SDK tests on Linux, macOS, and Windows, installed-package checks, MCP tests, and container checks. The final merged head must also pass those checks before merge. Local policy fixture failures were traced to a shared temporary Git marker and a custom Git build; the affected fixtures pass using an isolated temporary root and system Git.

The eval frozen-lockfile check succeeds, but full eval dependency installation is unavailable locally because the configured registry blocks openai@7.15.0 under its package publication-age policy (HTTP 403). The lockfile keeps the other resolved dependency versions; OpenCode's integrity was verified against the configured registry. No live model evaluations were run.

Risk and rollout

Reviewed upstream release notes and exact shipped source/types against repository uses. The supported SDK Node.js 22.13.0, 24, and 26 lines remain unchanged; the separate eval runner requires Node.js 22.22.0 or newer. MCP SDK 1.30.0 adds its upstream 10 MiB stdio buffering limit. Existing scan-integrity, credential, and path protections remain in place. No public commands or flags change. Merge after the normal review and CI gates pass; revert the dependency change if a regression appears.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	🔄 Running since 2026-09-11T21:06:55.890847Z	9fbeeb2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed the final integrated dependency update, MCP compatibility fixes, and removal of obsolete declarations and the duplicate generated-code test. The final CI run passed all 42 applicable jobs, with two intentional skips; security review passed and no review threads remain unresolved.

[mldangelo-oai]

Reviewed the exact dependency releases and shipped APIs, the compatibility fixes and simplifications, and the completed test and package evidence. Current-head CI and automated security review pass. The documented eval installation limitation does not affect the required deterministic harness checks.