chore(deps): upgrade typescript, vitest, and MCP SDK to latest (#633)

typescript 5.9.3 to 7.0.2, vitest 4.1.10 to 5.0.3 (plus
@vitest/coverage-v8 and @fast-check/vitest 0.5.0 for peer compat),
@Modelcontextprotocol/client and server 2.0.0 to 2.3.1. Migrate the
removed describe.sequential to concurrent:false and regenerate
package metadata and product catalog.

Also restore byte-faithful reads in parseCliJsonInput: the safeJson
migration dropped the fatal UTF-8 check from #613. Vitest 5 requires
Node 22/24/26+, so verify on Node 24 (repo-pinned toolchain).

docs/product-catalog.json

@@ -3,9 +3,9 @@
     "name": "rea-agents",
     "version": "4.0.1",
     "sdk": {
-      "server": "2.0.0",
-      "client": "2.0.0",
-      "core": "2.0.0"
+      "server": "2.3.1",
+      "client": "2.3.1",
+      "core": "2.3.1"
     },
     "skill_version": "24"
   },

package.json

@@ -171,8 +171,8 @@
     "@electron/asar": "4.2.0",
     "@jridgewell/trace-mapping": "0.3.31",
     "@lydell/node-pty": "1.1.0",
-    "@modelcontextprotocol/client": "2.0.0",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/server": "2.3.1",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/headless": "6.0.0",
     "@zip.js/zip.js": "2.8.26",
@@ -195,13 +195,13 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@fast-check/vitest": "0.4.1",
+    "@fast-check/vitest": "0.5.0",
     "@types/cross-spawn": "6.0.6",
     "@types/node": "24.10.1",
     "@types/semver": "7.7.1",
     "@types/write-file-atomic": "4.0.3",
     "@types/ws": "8.18.1",
-    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/coverage-v8": "5.0.3",
     "ajv": "8.20.0",
     "husky": "9.1.7",
     "jscpd": "5.0.12",
@@ -211,8 +211,8 @@
     "oxlint": "1.73.0",
     "turbo": "2.10.5",
     "typedoc": "0.28.20",
-    "typescript": "5.9.3",
-    "vitest": "4.1.10",
+    "typescript": "7.0.2",
+    "vitest": "5.0.3",
     "yaml": "2.9.0"
   }
 }

src/cliJsonInput.ts

@@ -17,10 +17,12 @@ export const parseCliJsonInput = async (
   if (["{", "["].includes(value.trimStart()[0] ?? ""))
     return { ok: false, error: inputError(operation) };
   try {
-    const decoded = safeParseJson(await readFile(value, "utf8"));
-    return decoded.ok
-      ? { ok: true, value: decoded.value }
-      : jsonFileError(value, operation, "invalid-json");
+    // Read raw bytes so invalid UTF-8 is rejected by parseJson instead of
+    // being silently replaced by lossy "utf8" decoding.
+    const parsed = parseJson(await readFile(value));
+    return parsed === undefined
+      ? jsonFileError(value, operation, "invalid-json")
+      : { ok: true, value: parsed };
   } catch (cause: unknown) {
     return jsonFileError(value, operation, "read-failed", cause);
   }

src/generatedPackageMetadata.ts

@@ -2,8 +2,8 @@
 export const PACKAGE_METADATA = {
   name: "rea-agents",
   version: "4.0.1", // x-release-please-version
-  serverSdkVersion: "2.0.0",
-  clientSdkVersion: "2.0.0",
-  coreSdkVersion: "2.0.0",
+  serverSdkVersion: "2.3.1",
+  clientSdkVersion: "2.3.1",
+  coreSdkVersion: "2.3.1",
   skillVersion: "24",
 } as const;

tests/boundary/filesystem/temporaryDirectory.test.ts

@@ -6,7 +6,7 @@ import { describe, expect, it } from "vitest";
 
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 
-describe.sequential("test temporary directory ownership", () => {
+describe("test temporary directory ownership", { concurrent: false }, () => {
   let completedDirectory: string | undefined;
 
   it("creates a canonical directory owned by the current test", async () => {

tests/process-global/verifierRun.test.ts

@@ -12,7 +12,7 @@ import { waitForExit } from "../support/process/processFixture.js";
 const execFileAsync = promisify(execFile);
 const CHILD_SHUTDOWN_GRACE_MS = 1_000;
 
-describe.sequential("verifier run identity", () => {
+describe("verifier run identity", { concurrent: false }, () => {
   it("allocates, propagates, and reuses one process-local identity", async () => {
     const previousRunId = process.env.REA_PROCESS_RUN_ID;
     process.env.REA_PROCESS_RUN_ID = "11111111-1111-4111-8111-111111111111";