build(deps): synchronize workspace package.json versions with lockfile and enforce in CI

[taranarmo]

TLDR

Synchronize workspace package.json dependency versions with package-lock.json and extend scripts/check-lockfile.js to prevent lockfile version desynchronization across workspaces in CI.

Dive Deeper

Similar to PR #3501 and PR #5336, hermetic downstream build tools (such as Nix and sandboxed package managers) rely on fixed-output derivations and pruned packument caches. When a dependency is pinned to an exact version in a workspace package.json (such as tar: 7.5.8 or clipboardy: 5.2.0), but the locked node_modules tree resolves to a newer patch (such as 7.5.11 or 5.2.1), offline npm ci fails with ETARGET: No matching version found for tar@7.5.8.

Additionally, packages/vscode-ide-companion/node_modules/typescript resolved to 5.9.3 instead of the root-hoisted 5.8.3, triggering peer dependency warnings (ERESOLVE) against @typescript-eslint/eslint-plugin@8.31.1 (peer typescript <5.9.0).

This PR:

1. Aligns the version numbers in workspace package.json files with the locked versions in package-lock.json (tar: 7.5.11, clipboardy: 5.2.1).
2. Deduplicates vitest in packages/a2a-server and packages/sdk and typescript in vscode-ide-companion to their root monorepo counterparts (3.2.4 and 5.8.3 respectively), resolving the peer dependency conflict.
3. Extends scripts/check-lockfile.js to ensure CI automatically checks that workspace package.json declared dependencies match the versions resolved in package-lock.json.

Reviewer Test Plan

1. Verify npm run check:lockfile passes:

   npm run check:lockfile

2. Verify offline installation succeeds:

   npm ci --offline --dry-run

3. Verify test suite and build pass:

   npm run bundle

Testing Matrix

	🍏	🪟	🐧
npm run	❓	❓	✅
npx	❓	❓	❓
Docker	❓	❓	✅
Podman	-	-	-
Seatbelt	-	-	-

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

📊 PR Size: size/L

• Lines changed: 464
• Additions: +78
• Deletions: -386
• Files changed: 4

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses critical dependency version mismatches between workspace package.json files and the root package-lock.json. By synchronizing these versions and implementing a new automated check in the CI pipeline, the changes ensure that downstream build tools—such as Nix and other sandboxed environments—can successfully perform offline installations without encountering target resolution errors or peer dependency conflicts.

Highlights

• Dependency Synchronization: Aligned workspace package.json dependency versions with the resolved versions in package-lock.json to ensure consistency and prevent build failures in hermetic environments.
• CI Enforcement: Extended scripts/check-lockfile.js to automatically validate that workspace dependencies match the lockfile, preventing future desynchronization.
• Dependency Deduplication: Resolved peer dependency conflicts by deduplicating vitest and typescript versions across workspaces to match root monorepo versions.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates dependency versions for tar and clipboardy across packages, cleans up unused transitive dependencies in package-lock.json, and introduces a new validation check in scripts/check-lockfile.js to ensure workspace dependencies in package.json match resolutions in package-lock.json. Feedback on the new check highlights a critical issue where local workspace symlinks (represented as link entries in package-lock.json without a version property) will cause false positives and fail the CI check, and a code suggestion is provided to resolve the links to their target packages.

[gemini-code-assist]

In package-lock.json (v2/v3), workspace dependencies or local symlinked packages are represented as link entries (e.g., "node_modules/dep": { "resolved": "packages/dep", "link": true }) which do not contain a version property. The actual version is defined in the target package entry (e.g., "packages/dep").

Since internal workspace dependencies often use exact versions (e.g., "0.65.0-nightly..."), comparing the exact version against resolvedPkg.version (which is undefined for links) will trigger false positives and fail the CI check.

To fix this, resolve the link to the target package if link is true.

Suggested change

	const resolvedPkg =
	packages[`${ws}/node_modules/${dep}`] ||
	packages[`node_modules/${dep}`];
	const linkPkg =
	packages[ws + "/node_modules/" + dep] ||
	packages["node_modules/" + dep];
	const resolvedPkg = linkPkg && linkPkg.link ? packages[linkPkg.resolved] : linkPkg;