build(deps): update deps with security issues (pass 1) (#10119)

README.md

@@ -243,8 +243,3 @@ implement git hooks. We leverage the prepush hook to do two things:
 See [Contributing](./CONTRIBUTING.md) for more information on contributing to the Firebase
 JavaScript SDK.
 
-### Big Thanks
-
-Cross-browser Testing Platform and Open Source <3 Provided by [Sauce Labs][homepage]
-
-[homepage]: https://saucelabs.com

config/functions/package.json

@@ -3,8 +3,8 @@
   "description": "Cloud Functions for Firebase",
   "dependencies": {
     "cors": "2.8.5",
-    "firebase-admin": "11.11.1",
+    "firebase-admin": "^13.10.0",
-    "firebase-functions": "^7.0.0"
+    "firebase-functions": "^7.2.5"
   },
   "private": true,
   "engines": {

config/karma.saucelabs.js

@@ -1,237 +0,0 @@
-/**
- * @license
- * Copyright 2017 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-const argv = require('yargs').argv;
-const path = require('path');
-const karmaBase = require('./karma.base');
-
-// karma.conf.js test configuration file to run.
-const testConfigFile = argv['testConfigFile'];
-if (!testConfigFile) {
-  console.error('No test file path provided.');
-  process.exit(1);
-}
-
-/**
- * Custom SauceLabs Launchers
- */
-const browserMap = {
-  // Desktop
-  Chrome_Windows: seleniumLauncher('chrome', 'Windows 10', 'latest'),
-  Firefox_Windows: seleniumLauncher('firefox', 'Windows 10', 'latest'),
-  Safari_macOS: seleniumLauncher('safari', 'macOS 10.13', 'latest'),
-  Edge_Windows: seleniumLauncher('MicrosoftEdge', 'Windows 10', 'latest'),
-  IE_Windows: seleniumLauncher('internet explorer', 'Windows 10', 'latest')
-
-  // Mobile
-  // Safari_iOS: appiumLauncher('Safari', 'iPhone Simulator', 'iOS', '11.2'),
-  // Chrome_Android: appiumLauncher('Chrome', 'Android Emulator', 'Android', '6.0')
-};
-
-/**
- * Any special options per package.
- */
-const packageConfigs = {
-  '@firebase/messaging': {
-    // Messaging currently only supports these browsers.
-    browsers: ['Chrome_Windows', 'Firefox_Windows', 'Edge_Windows']
-  },
-  // Firestore unit tests have OOM problems compiling with Babel for IE.
-  // Firestore integration/firestore tests do run on all browsers.
-  '@firebase/firestore': {
-    browsers: [
-      'Chrome_Windows',
-      'Firefox_Windows',
-      'Edge_Windows',
-      'Safari_macOS'
-    ]
-  },
-  // Installations has IE errors related to `idb` library that need to be figured out.
-  '@firebase/installations': {
-    browsers: [
-      'Chrome_Windows',
-      'Firefox_Windows',
-      'Edge_Windows',
-      'Safari_macOS'
-    ]
-  }
-};
-
-/**
- * Gets the browser/launcher map for this package.
- *
- * @param {string} packageName Name of package being tested (e.g., "firestore")
- */
-function getSauceLabsBrowsers(packageName) {
-  if (packageConfigs[packageName]) {
-    const filteredBrowserMap = {};
-    for (const browserKey in browserMap) {
-      if (packageConfigs[packageName].browsers.includes(browserKey)) {
-        filteredBrowserMap[browserKey] = browserMap[browserKey];
-      }
-    }
-    return filteredBrowserMap;
-  } else {
-    return browserMap;
-  }
-}
-
-/**
- * Get package name from package path command line arg.
- */
-function getPackageLabels() {
-  const match = testConfigFile.match(
-    /([a-zA-Z]+\/[a-zA-Z-]+)\/karma\.conf\.js/
-  );
-  const packagePath = match[1];
-  const root = path.resolve(__dirname, '..');
-  const pkg = require(path.join(root, packagePath, 'package.json'));
-  return pkg.name;
-}
-
-/**
- * Gets a list of file patterns for test, defined individually
- * in karma.conf.js in each package under workspace packages or
- * integration.
- */
-function getTestFiles() {
-  let root = path.resolve(__dirname, '..');
-  const { name: packageName } = getPackageLabels();
-  let patterns = require(path.join(root, testConfigFile)).files;
-  let dirname = path.dirname(testConfigFile);
-  return { packageName, files: patterns.map(p => path.join(dirname, p)) };
-}
-
-function seleniumLauncher(browserName, platform, version) {
-  const { name } = getPackageLabels();
-  const testName = `${name}-${browserName}`;
-  return {
-    base: 'SauceLabs',
-    browserName: browserName,
-    extendedDebugging: 'true',
-    name: testName,
-    recordLogs: 'true',
-    recordVideo: 'true',
-    recordScreenshots: 'true',
-    platform: platform,
-    version: version
-  };
-}
-
-function appiumLauncher(
-  browserName,
-  deviceName,
-  platformName,
-  platformVersion
-) {
-  return {
-    base: 'SauceLabs',
-    browserName: browserName,
-    deviceName: deviceName,
-    deviceOrientation: 'portrait',
-    extendedDebugging: 'true',
-    recordLogs: 'true',
-    recordVideo: 'true',
-    recordScreenshots: 'true',
-    platformName: platformName,
-    platformVersion: platformVersion,
-    idleTimeout: 120
-  };
-}
-
-module.exports = function (config) {
-  const { packageName, files: testFiles } = getTestFiles();
-  const sauceLabsBrowsers = getSauceLabsBrowsers(packageName);
-
-  const sauceLabsConfig = {
-    tunnelIdentifier: process.env.GITHUB_RUN_ID + '-' + packageName,
-    build: process.env.GITHUB_RUN_ID || argv['buildNumber'],
-    username: process.env.SAUCE_USERNAME,
-    accessKey: process.env.SAUCE_ACCESS_KEY,
-    startConnect: true,
-    connectOptions: {
-      // Realtime Database uses WebSockets to connect to firebaseio.com
-      // so we have to set noSslBumpDomains. Theoretically SSL Bumping
-      // only needs to be disabled for 'firebaseio.com'. However, we are
-      // seeing much longer test time with that configuration, so leave
-      // it as 'all' for now.
-      // See https://wiki.saucelabs.com/display/DOCS/Troubleshooting+Sauce+Connect
-      // for more details.
-      noSslBumpDomains: 'all'
-    }
-  };
-
-  const karmaConfig = Object.assign({}, karmaBase, {
-    basePath: '../',
-
-    files: ['packages/polyfill/index.ts', ...testFiles],
-
-    logLevel: config.LOG_INFO,
-
-    preprocessors: {
-      'packages/polyfill/index.ts': ['webpack', 'sourcemap'],
-      '**/test/**/*.ts': ['webpack', 'sourcemap'],
-      '**/*.test.ts': ['webpack', 'sourcemap'],
-      // Restore when ready to run Firestore unit tests in IE.
-      // 'packages/firestore/test/**/bootstrap.ts': ['webpack', 'babel'],
-      'integration/**/namespace.*': ['webpack', 'babel', 'sourcemap']
-    },
-
-    babelPreprocessor: { options: { presets: ['@babel/preset-env'] } },
-
-    frameworks: ['mocha'],
-
-    browserNoActivityTimeout: 900000,
-
-    browserDisconnectTolerance: 3,
-
-    captureTimeout: 120000,
-
-    // browsers: ['ChromeHeadless'],
-    browsers: Object.keys(sauceLabsBrowsers),
-
-    customLaunchers: sauceLabsBrowsers,
-
-    reporters: ['spec', 'summary', 'saucelabs'],
-
-    port: 9876,
-
-    retryLimit: 3,
-
-    // concurrency: 10,
-
-    specReporter: {
-      maxLogLines: 5,
-      suppressErrorSummary: false,
-      suppressFailed: false,
-      suppressPassed: true,
-      suppressSkipped: true,
-      showSpecTiming: true,
-      failFast: false
-    },
-
-    summaryReporter: {
-      show: 'failed',
-      specLength: 80,
-      overviewColumn: false
-    },
-
-    sauceLabs: sauceLabsConfig
-  });
-
-  config.set(karmaConfig);
-};

integration/messaging/package.json

@@ -9,10 +9,10 @@
     "test:manual": "mocha --exit"
   },
   "devDependencies": {
-    "firebase": "12.15.0",
     "chai": "4.5.0",
     "chromedriver": "119.0.1",
-    "express": "4.21.2",
+    "express": "5.2.1",
+    "firebase": "12.15.0",
     "geckodriver": "2.0.4",
     "mocha": "9.2.2",
     "selenium-assistant": "6.1.1"

package.json

@@ -37,7 +37,6 @@
     "test:coverage": "lcov-result-merger 'packages/**/lcov.info' | coveralls",
     "test:changed": "ts-node-script scripts/ci-test/test_changed.ts",
     "test:setup": "node tools/config.js",
-    "test:saucelabs": "node scripts/run_saucelabs.js",
     "trusted-type-check": "lerna run --scope @firebase/* trusted-type-check --no-bail",
     "docgen": "ts-node-script scripts/docgen/docgen.ts",
     "docgen:compat": "node scripts/docgen-compat/generate-docs.js --api js",
@@ -104,7 +103,7 @@
     "eslint": "8.57.1",
     "eslint-plugin-import": "2.31.0",
     "eslint-plugin-unused-imports": "3.2.0",
-    "express": "4.21.2",
+    "express": "5.2.1",
     "find-free-port": "2.0.0",
     "firebase-tools": "13.30.0",
     "glob": "7.2.3",
@@ -141,14 +140,12 @@
     "postinstall-postinstall": "2.1.0",
     "prettier": "2.8.8",
     "protobufjs-cli": "^1.1.3",
-    "protractor": "5.4.2",
     "request": "2.88.2",
     "semver": "7.7.1",
-    "simple-git": "3.32.3",
+    "simple-git": "3.36.0",
     "sinon": "9.2.4",
     "sinon-chai": "3.7.0",
     "source-map-loader": "1.1.3",
-    "sqlite3": "5.1.7",
     "terser": "5.38.1",
     "ts-loader": "9.5.2",
     "ts-node": "10.9.2",
@@ -156,7 +153,6 @@
     "tslint": "6.1.3",
     "typedoc": "0.16.11",
     "typescript": "5.5.4",
-    "watch": "1.0.2",
     "webpack": "5.104.1",
     "yargs": "17.7.2"
   }

packages/auth/demo/functions/package.json

@@ -9,8 +9,11 @@
     "logs": "firebase functions:log"
   },
   "dependencies": {
-    "firebase-admin": "11.11.1",
+    "firebase-admin": "^13.10.0",
-    "firebase-functions": "3.24.1"
+    "firebase-functions": "^7.2.5"
   },
-  "private": true
+  "private": true,
+  "engines": {
+    "node": ">=20"
+  }
 }

packages/auth/package.json

@@ -135,6 +135,7 @@
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-strip": "3.0.4",
     "@types/express": "4.17.21",
+    "@types/selenium-webdriver": "4.35.6",
     "chromedriver": "119.0.1",
     "cookie-store": "4.0.0-next.4",
     "rollup": "2.79.2",

packages/rules-unit-testing/functions/package.json

@@ -8,8 +8,8 @@
   },
   "private": true,
   "dependencies": {
-    "firebase-admin": "11.11.1",
+    "firebase-admin": "^13.10.0",
-    "firebase-functions": "3.24.1"
+    "firebase-functions": "^7.2.5"
   },
   "engines": {
     "node": ">=16"

packages/webchannel-wrapper/package.json

@@ -23,7 +23,7 @@
     "webchannel-blob/package.json"
   ],
   "scripts": {
-    "dev": "watch 'yarn build' src",
+    "dev": "rollup -c -w",
     "build": "rollup -c",
     "test": "echo 'No test suite for webchannel-wrapper'",
     "test:ci": "echo 'No test suite for webchannel-wrapper'",

renovate.json

@@ -11,7 +11,6 @@
     }
   ],
   "ignoreDeps": [
-    "protractor",
     "long",
     "rollup-plugin-copy-assets",
     "typedoc",

scripts/run_saucelabs.js

@@ -1,178 +0,0 @@
-/**
- * @license
- * Copyright 2019 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-const { spawn } = require('child-process-promise');
-const { exists } = require('mz/fs');
-const yargs = require('yargs');
-const glob = require('glob');
-const path = require('path');
-const chalk = require('chalk');
-
-// Check for 'configFiles' flag to run on specified karma.conf.js files instead
-// of on all files.
-const { configFiles } = yargs
-  .option('configFiles', {
-    default: [],
-    describe: 'specify individual karma.conf.js files to run on',
-    type: 'array'
-  })
-  .version(false)
-  .help().argv;
-
-// Get all karma.conf.js files that need to be run.
-// runNextTest() pulls filenames one-by-one from this queue.
-const testFiles = configFiles.length
-  ? configFiles
-  : glob
-      .sync(`packages/*/karma.conf.js`)
-      // Skip integration namespace tests, not very useful, introduce errors.
-      .concat('integration/firestore/karma.conf.js')
-      // Exclude database - currently too many failures.
-      .filter(name => !name.includes('packages/database'));
-
-// Get CI build number or generate one if running locally.
-const buildNumber =
-  process.env.TRAVIS_BUILD_NUMBER ||
-  process.env.GITHUB_RUN_ID ||
-  `local_${process.env.USER}_${new Date().getTime()}`;
-
-/**
- * Runs a set of SauceLabs browser tests based on this karma config file.
- *
- * @param {string} testFile Path to karma.conf.js file that defines this test
- * group.
- */
-async function runTest(testFile) {
-  if (!(await exists(testFile))) {
-    console.error(chalk`{red ERROR: ${testFile} does not exist.}`);
-    return 1;
-  }
-  // Run pretest if this dir has a package.json with a pretest script.
-  const testFileDir =
-    path.resolve(__dirname, '../') + '/' + path.dirname(testFile);
-  const pkgPath = testFileDir + '/package.json';
-  let pkgName = testFile;
-  if (await exists(pkgPath)) {
-    const pkg = require(pkgPath);
-    pkgName = pkg.name;
-    if (pkg.scripts.pretest) {
-      await spawn('yarn', ['--cwd', testFileDir, 'pretest'], {
-        stdio: 'inherit'
-      });
-    }
-  }
-  if (testFile.includes('integration/firestore')) {
-    console.log(
-      chalk`{blue Generating memory-only build for integration/firestore.}`
-    );
-    await spawn('yarn', ['--cwd', 'integration/firestore', 'build:memory'], {
-      stdio: 'inherit'
-    });
-    console.log(
-      chalk`{blue Running tests on memory-only build for integration/firestore.}`
-    );
-    const exitCode1 = await runKarma(testFile, `${pkgName}-memory`);
-    console.log(
-      chalk`{blue Generating persistence build for integration/firestore.}`
-    );
-    await spawn(
-      'yarn',
-      ['--cwd', 'integration/firestore', 'build:persistence'],
-      { stdio: 'inherit' }
-    );
-    console.log(
-      chalk`{blue Running tests on persistence build for integration/firestore.}`
-    );
-    const exitCode2 = await runKarma(testFile, `${pkgName}-persistence`);
-    return Math.max(exitCode1, exitCode2);
-  } else {
-    return runKarma(testFile, pkgName);
-  }
-}
-
-/**
- * Runs the karma test command for one package.
- *
- * @param {string} testFile - path to karma.conf.js file
- * @param {string} testTag - package label for messages (usually package name)
- */
-async function runKarma(testFile, testTag) {
-  const karmaArgs = [
-    'karma',
-    'start',
-    'config/karma.saucelabs.js',
-    '--single-run',
-    '--testConfigFile',
-    testFile,
-    '--buildNumber',
-    buildNumber
-  ];
-
-  const promise = spawn('npx', karmaArgs, { stdio: 'inherit' });
-  const childProcess = promise.childProcess;
-  let exitCode = 0;
-
-  // Capture exit code of this single package test run
-  childProcess.on('exit', code => {
-    exitCode = code;
-  });
-
-  return promise
-    .then(() => {
-      console.log(chalk`{green [${testTag}] ******* DONE *******}`);
-      return exitCode;
-    })
-    .catch(err => {
-      console.error(chalk`{red [${testTag}] ERROR: ${err.message}}`);
-      return exitCode;
-    });
-}
-
-/**
- * Runs next file in testFiles queue as long as there are files in the queue.
- *
- * @param {number} maxExitCode Current highest exit code from all processes
- * run so far. When main process is complete, it will exit with highest code
- * of all child processes.  This allows any failing test to result in a CI
- * build failure for the whole Saucelabs run.
- */
-async function runNextTest(maxExitCode = 0, results = {}) {
-  // When test queue is empty, exit with code 0 if no tests failed or
-  // 1 if any tests failed.
-  if (!testFiles.length) {
-    for (const fileName of Object.keys(results)) {
-      if (results[fileName] > 0) {
-        console.log(`FAILED: ${fileName}`);
-      }
-    }
-    process.exit(maxExitCode);
-  }
-  const nextFile = testFiles.shift();
-  let exitCode;
-  try {
-    exitCode = await runTest(nextFile);
-  } catch (e) {
-    console.error(chalk`{red [${nextFile}] ERROR: ${e.message}}`);
-    exitCode = 1;
-  }
-  runNextTest(Math.max(exitCode, maxExitCode), {
-    ...results,
-    [nextFile]: exitCode
-  });
-}
-
-runNextTest();