Replace node-fetch dependency with undici (#7705)

Update our dependency on aging `node-fetch` `v2.6.7` to `undici` `v5.26.5`. This should fix some vulnerabilities within node-fetch as well as fix user issue #7660.
2026-09-24 16:59:10 +00:00 · 2023-11-12 10:07:48 -05:00
parent 89e4dc8c2e
commit c0eb8c5833
27 changed files with 147756 additions and 194 deletions
@@ -0,0 +1,11 @@
+---
+'@firebase/auth-compat': minor
+'@firebase/firestore': minor
+'@firebase/functions': minor
+'@firebase/storage': minor
+'@firebase/auth': minor
+'firebase': minor
+---
+
+Replaced node-fetch v2.6.7 dependency with the latest version of undici (v5.26.5) in Node.js SDK
+builds for auth, firestore, functions and storage.
@@ -15,7 +15,7 @@
    "express": "4.18.2",
    "geckodriver": "2.0.4",
    "mocha": "9.2.2",
-    "node-fetch": "2.6.7",
+    "undici": "5.26.5",
    "selenium-assistant": "6.1.1"
  }
 }
@@ -15,7 +15,7 @@
 * limitations under the License.
 */

-const fetch = require('node-fetch');
+const undici = require('undici');
 const FCM_SEND_ENDPOINT = 'https://fcm.googleapis.com/fcm/send';
 // Rotatable fcm server key. It's generally a bad idea to expose server keys. The reason is to
 // simplify testing process (no need to implement server side decryption of git secret). The
@@ -28,7 +28,7 @@ module.exports = async payload => {
    'Requesting to send an FCM message with payload: ' + JSON.stringify(payload)
  );

-  const response = await fetch(FCM_SEND_ENDPOINT, {
+  const response = await undici.fetch(FCM_SEND_ENDPOINT, {
    method: 'POST',
    body: JSON.stringify(payload),
    headers: {
@@ -153,6 +153,7 @@
    "tslint": "6.1.3",
    "typedoc": "0.16.11",
    "typescript": "4.7.4",
+    "undici": "5.26.5",
    "watch": "1.0.2",
    "webpack": "5.76.0",
    "yargs": "17.7.2"
@@ -23,11 +23,15 @@
 */
 export * from './index';
 import { FetchProvider } from '@firebase/auth/internal';
-import * as fetchImpl from 'node-fetch';
+import {
+  fetch as undiciFetch,
+  Headers as undiciHeaders,
+  Response as undiciResponse
+} from 'undici';
 import './index';

 FetchProvider.initialize(
-  fetchImpl.default as unknown as typeof fetch,
-  fetchImpl.Headers as unknown as typeof Headers,
-  fetchImpl.Response as unknown as typeof Response
+  undiciFetch as unknown as typeof fetch,
+  undiciHeaders as unknown as typeof Headers,
+  undiciResponse as unknown as typeof Response
 );
@@ -16,6 +16,7 @@
 */

 const karmaBase = require('../../config/karma.base');
+const webpackBase = require('../../config/webpack.test');
 const { argv } = require('yargs');

 const files = ['src/**/*.test.ts'];
@@ -29,6 +30,17 @@ module.exports = function (config) {
    // frameworks to use
    // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
    frameworks: ['mocha'],
+    // undici is a fetch polyfill that test helpers call for Node tests, and browser tests should
+    // ingore its import to avoid compilation errors in those test helpers.
+    webpack: {
+      ...webpackBase,
+      resolve: {
+        ...webpackBase.resolve,
+        alias: {
+          'undici': false
+        }
+      }
+    },

    client: Object.assign({}, karmaBase.client, getClientConfig())
  });
@@ -54,7 +54,7 @@
    "@firebase/auth-types": "0.12.0",
    "@firebase/component": "0.6.4",
    "@firebase/util": "1.9.3",
-    "node-fetch": "2.6.7",
+    "undici": "5.26.5",
    "tslib": "^2.1.0"
  },
  "license": "Apache-2.0",
@@ -16,6 +16,7 @@
 */

 const karmaBase = require('../../config/karma.base');
+const webpackBase = require('../../config/webpack.test');
 const { argv } = require('yargs');

 module.exports = function (config) {
@@ -26,7 +27,17 @@ module.exports = function (config) {
    // frameworks to use
    // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
    frameworks: ['mocha'],
-
+    // undici is a fetch polyfill that test helpers call for Node tests, and browser tests should
+    // ingore its import to avoid compilation errors in those test helpers.
+    webpack: {
+      ...webpackBase,
+      resolve: {
+        ...webpackBase.resolve,
+        alias: {
+          'undici': false
+        }
+      }
+    },
    client: Object.assign({}, karmaBase.client, getClientConfig(argv))
  });

@@ -115,7 +115,7 @@
    "@firebase/component": "0.6.4",
    "@firebase/logger": "0.4.0",
    "@firebase/util": "1.9.3",
-    "node-fetch": "2.6.7",
+    "undici": "5.26.5",
    "tslib": "^2.1.0"
  },
  "license": "Apache-2.0",
@@ -27,14 +27,18 @@ import { ClientPlatform } from '../core/util/version';
 import { AuthImpl } from '../core/auth/auth_impl';

 import { FetchProvider } from '../core/util/fetch_provider';
-import * as fetchImpl from 'node-fetch';
 import { getDefaultEmulatorHost } from '@firebase/util';
+import {
+  fetch as undiciFetch,
+  Headers as undiciHeaders,
+  Response as undiciResponse
+} from 'undici';

 // Initialize the fetch polyfill, the types are slightly off so just cast and hope for the best
 FetchProvider.initialize(
-  fetchImpl.default as unknown as typeof fetch,
-  fetchImpl.Headers as unknown as typeof Headers,
-  fetchImpl.Response as unknown as typeof Response
+  undiciFetch as unknown as typeof fetch,
+  undiciHeaders as unknown as typeof Headers,
+  undiciResponse as unknown as typeof Response
 );

 // First, we set up the various platform-specific features for Node (register
@@ -15,7 +15,7 @@
 * limitations under the License.
 */

-import * as fetchImpl from 'node-fetch';
+import { fetch as undiciFetch, RequestInit as undiciRequestInit } from 'undici';
 import { getAppConfig, getEmulatorUrl } from './settings';

 export interface VerificationSession {
@@ -87,10 +87,10 @@ function buildEmulatorUrlForPath(endpoint: string): string {
 function doFetch(url: string, request?: RequestInit): ReturnType<typeof fetch> {
  if (typeof document !== 'undefined') {
    return fetch(url, request);
-  }
-
-  return fetchImpl.default(
+  } else {
+    return undiciFetch(
      url,
-    request as fetchImpl.RequestInit
+      request as undiciRequestInit
    ) as unknown as ReturnType<typeof fetch>;
  }
+}
@@ -102,7 +102,7 @@
    "@firebase/webchannel-wrapper": "0.10.3",
    "@grpc/grpc-js": "~1.9.0",
    "@grpc/proto-loader": "^0.7.8",
-    "node-fetch": "2.6.7",
+    "undici": "5.26.5",
    "tslib": "^2.1.0"
  },
  "peerDependencies": {
@@ -15,7 +15,7 @@
 * limitations under the License.
 */

-import nodeFetch from 'node-fetch';
+import { fetch as undiciFetch } from 'undici';

 import { DatabaseInfo } from '../../core/database_info';
 import { Connection } from '../../remote/connection';
@@ -25,8 +25,8 @@ export { newConnectivityMonitor } from '../browser/connection';

 /** Initializes the HTTP connection for the REST API. */
 export function newConnection(databaseInfo: DatabaseInfo): Connection {
-  // node-fetch is meant to be API compatible with `fetch`, but its type doesn't
+  // undici is meant to be API compatible with `fetch`, but its type doesn't
  // match 100%.
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  return new FetchConnection(databaseInfo, nodeFetch as any);
+  return new FetchConnection(databaseInfo, undiciFetch as any);
 }
@@ -16,6 +16,7 @@
 */

 const karmaBase = require('../../config/karma.base');
+const webpackBase = require('../../config/webpack.test');

 const files = [`src/**/*.test.ts`];

@@ -25,7 +26,18 @@ module.exports = function (config) {
    files,
    // frameworks to use
    // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
-    frameworks: ['mocha']
+    frameworks: ['mocha'],
+    // undici is a fetch polyfill that test helpers call for Node tests, and browser tests should
+    // ingore its import to avoid compilation errors in those test helpers.
+    webpack: {
+      ...webpackBase,
+      resolve: {
+        ...webpackBase.resolve,
+        alias: {
+          'undici': false
+        }
+      }
+    }
  });

  config.set(karmaConfig);
@@ -71,7 +71,7 @@
    "@firebase/auth-interop-types": "0.2.1",
    "@firebase/app-check-interop-types": "0.3.0",
    "@firebase/util": "1.9.3",
-    "node-fetch": "2.6.7",
+    "undici": "5.26.5",
    "tslib": "^2.1.0"
  },
  "nyc": {
@@ -15,9 +15,9 @@
 * limitations under the License.
 */
 import { registerFunctions } from './config';
-import nodeFetch from 'node-fetch';
+import { fetch as undiciFetch } from 'undici';

 export * from './api';

 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-registerFunctions(nodeFetch as any, 'node');
+registerFunctions(undiciFetch as any, 'node');
@@ -21,7 +21,7 @@ import { FirebaseAuthInternalName } from '@firebase/auth-interop-types';
 import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
 import { FunctionsService } from '../src/service';
 import { connectFunctionsEmulator } from '../src/api';
-import nodeFetch from 'node-fetch';
+import { fetch as undiciFetch } from 'undici';
 import { MessagingInternalComponentName } from '../../../packages/messaging-interop-types';

 export function makeFakeApp(options: FirebaseOptions = {}): FirebaseApp {
@@ -59,7 +59,7 @@ export function createTestService(
  )
 ): FunctionsService {
  const fetchImpl: typeof fetch =
-    typeof window !== 'undefined' ? fetch.bind(window) : (nodeFetch as any);
+    typeof window !== 'undefined' ? fetch.bind(window) : (undiciFetch as any);
  const functions = new FunctionsService(
    app,
    authProvider,
@@ -2,91 +2,91 @@
 # yarn lockfile v1


-"@babel/parser@^7.9.4":
-  version "7.20.5"
-  resolved "https://registry.npmjs.org/@babel/parser/-/parser-7.20.5.tgz#7f3c7335fe417665d929f34ae5dceae4c04015e8"
-  integrity sha512-r27t/cy/m9uKLXQNWWebeCUHgnAZq0CpG1OwKRxzJMP1vpSU4bSIK2hq+/cp0bQxetkXx38n09rNu8jVkcK/zA==
+"@babel/parser@^7.20.15":
+  version "7.23.0"
+  resolved "https://registry.npmjs.org/@babel/parser/-/parser-7.23.0.tgz#da950e622420bf96ca0d0f2909cdddac3acd8719"
+  integrity sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==

-"@fastify/busboy@^1.1.0":
-  version "1.1.0"
-  resolved "https://registry.npmjs.org/@fastify/busboy/-/busboy-1.1.0.tgz#4472f856e2bb5a9ee34ad64b93891b73b73537ca"
-  integrity sha512-Fv854f94v0CzIDllbY3i/0NJPNBRNLDawf3BTYVGCe9VrIIs3Wi7AFx24F9NzCxdf0wyx/x0Q9kEVnvDOPnlxA==
+"@fastify/busboy@^1.2.1":
+  version "1.2.1"
+  resolved "https://registry.npmjs.org/@fastify/busboy/-/busboy-1.2.1.tgz#9c6db24a55f8b803b5222753b24fe3aea2ba9ca3"
+  integrity sha512-7PQA7EH43S0CxcOa9OeAnaeA0oQ+e/DHNPZwSQM9CQHW76jle5+OvLdibRp/Aafs9KXbLhxyjOTkRjWUbQEd3Q==
  dependencies:
    text-decoding "^1.0.0"

-"@firebase/app-types@0.8.1":
-  version "0.8.1"
-  resolved "https://registry.npmjs.org/@firebase/app-types/-/app-types-0.8.1.tgz#4c7f916281aed570581fc667e3eb6cc730119a95"
-  integrity sha512-p75Ow3QhB82kpMzmOntv866wH9eZ3b4+QbUY+8/DA5Zzdf1c8Nsk8B7kbFpzJt4wwHMdy5LTF5YUnoTc1JiWkw==
+"@firebase/app-types@0.9.0":
+  version "0.9.0"
+  resolved "https://registry.npmjs.org/@firebase/app-types/-/app-types-0.9.0.tgz#35b5c568341e9e263b29b3d2ba0e9cfc9ec7f01e"
+  integrity sha512-AeweANOIo0Mb8GiYm3xhTEBVCmPwTYAu9Hcd2qSkLuga/6+j9b1Jskl5bpiSQWy9eJ/j5pavxj6eYogmnuzm+Q==

-"@firebase/auth-interop-types@0.1.7":
-  version "0.1.7"
-  resolved "https://registry.npmjs.org/@firebase/auth-interop-types/-/auth-interop-types-0.1.7.tgz#82c8d431779916224d2af5cef6cec2042d830f28"
-  integrity sha512-yA/dTveGGPcc85JP8ZE/KZqfGQyQTBCV10THdI8HTlP1GDvNrhr//J5jAt58MlsCOaO3XmC4DqScPBbtIsR/EA==
+"@firebase/auth-interop-types@0.2.1":
+  version "0.2.1"
+  resolved "https://registry.npmjs.org/@firebase/auth-interop-types/-/auth-interop-types-0.2.1.tgz#78884f24fa539e34a06c03612c75f222fcc33742"
+  integrity sha512-VOaGzKp65MY6P5FI84TfYKBXEPi6LmOCSMMzys6o2BN2LOsqy7pCuZCup7NYnfbk5OkkQKzvIfHOzTm0UDpkyg==

-"@firebase/component@0.5.21":
-  version "0.5.21"
-  resolved "https://registry.npmjs.org/@firebase/component/-/component-0.5.21.tgz#bb10add24fe2ee59a61163a469d4711d8da4002d"
-  integrity sha512-12MMQ/ulfygKpEJpseYMR0HunJdlsLrwx2XcEs40M18jocy2+spyzHHEwegN3x/2/BLFBjR5247Etmz0G97Qpg==
+"@firebase/component@0.6.4":
+  version "0.6.4"
+  resolved "https://registry.npmjs.org/@firebase/component/-/component-0.6.4.tgz#8981a6818bd730a7554aa5e0516ffc9b1ae3f33d"
+  integrity sha512-rLMyrXuO9jcAUCaQXCMjCMUsWrba5fzHlNK24xz5j2W6A/SRmK8mZJ/hn7V0fViLbxC0lPMtrK1eYzk6Fg03jA==
  dependencies:
-    "@firebase/util" "1.7.3"
+    "@firebase/util" "1.9.3"
    tslib "^2.1.0"

-"@firebase/database-compat@^0.2.6":
-  version "0.2.10"
-  resolved "https://registry.npmjs.org/@firebase/database-compat/-/database-compat-0.2.10.tgz#fa4440db9f41a9a05112642504c1e6557a75b8be"
-  integrity sha512-fK+IgUUqVKcWK/gltzDU+B1xauCOfY6vulO8lxoNTkcCGlSxuTtwsdqjGkFmgFRMYjXFWWJ6iFcJ/vXahzwCtA==
+"@firebase/database-compat@^0.3.4":
+  version "0.3.4"
+  resolved "https://registry.npmjs.org/@firebase/database-compat/-/database-compat-0.3.4.tgz#4e57932f7a5ba761cd5ac946ab6b6ab3f660522c"
+  integrity sha512-kuAW+l+sLMUKBThnvxvUZ+Q1ZrF/vFJ58iUY9kAcbX48U03nVzIF6Tmkf0p3WVQwMqiXguSgtOPIB6ZCeF+5Gg==
  dependencies:
-    "@firebase/component" "0.5.21"
-    "@firebase/database" "0.13.10"
-    "@firebase/database-types" "0.9.17"
-    "@firebase/logger" "0.3.4"
-    "@firebase/util" "1.7.3"
+    "@firebase/component" "0.6.4"
+    "@firebase/database" "0.14.4"
+    "@firebase/database-types" "0.10.4"
+    "@firebase/logger" "0.4.0"
+    "@firebase/util" "1.9.3"
    tslib "^2.1.0"

-"@firebase/database-types@0.9.17", "@firebase/database-types@^0.9.13":
-  version "0.9.17"
-  resolved "https://registry.npmjs.org/@firebase/database-types/-/database-types-0.9.17.tgz#4c248052b0a9ae052ba940e4996a0bfab25dc257"
-  integrity sha512-YQm2tCZyxNtEnlS5qo5gd2PAYgKCy69tUKwioGhApCFThW+mIgZs7IeYeJo2M51i4LCixYUl+CvnOyAnb/c3XA==
+"@firebase/database-types@0.10.4", "@firebase/database-types@^0.10.4":
+  version "0.10.4"
+  resolved "https://registry.npmjs.org/@firebase/database-types/-/database-types-0.10.4.tgz#47ba81113512dab637abace61cfb65f63d645ca7"
+  integrity sha512-dPySn0vJ/89ZeBac70T+2tWWPiJXWbmRygYv0smT5TfE3hDrQ09eKMF3Y+vMlTdrMWq7mUdYW5REWPSGH4kAZQ==
  dependencies:
-    "@firebase/app-types" "0.8.1"
-    "@firebase/util" "1.7.3"
+    "@firebase/app-types" "0.9.0"
+    "@firebase/util" "1.9.3"

-"@firebase/[email protected]3.10":
-  version "0.13.10"
-  resolved "https://registry.npmjs.org/@firebase/database/-/database-0.13.10.tgz#c24e0219490b9c1fabfb7b42cb45850e145fe56d"
-  integrity sha512-KRucuzZ7ZHQsRdGEmhxId5jyM2yKsjsQWF9yv0dIhlxYg0D8rCVDZc/waoPKA5oV3/SEIoptF8F7R1Vfe7BCQA==
+"@firebase/[email protected]4.4":
+  version "0.14.4"
+  resolved "https://registry.npmjs.org/@firebase/database/-/database-0.14.4.tgz#9e7435a16a540ddfdeb5d99d45618e6ede179aa6"
+  integrity sha512-+Ea/IKGwh42jwdjCyzTmeZeLM3oy1h0mFPsTy6OqCWzcu/KFqRAr5Tt1HRCOBlNOdbh84JPZC47WLU18n2VbxQ==
  dependencies:
-    "@firebase/auth-interop-types" "0.1.7"
-    "@firebase/component" "0.5.21"
-    "@firebase/logger" "0.3.4"
-    "@firebase/util" "1.7.3"
+    "@firebase/auth-interop-types" "0.2.1"
+    "@firebase/component" "0.6.4"
+    "@firebase/logger" "0.4.0"
+    "@firebase/util" "1.9.3"
    faye-websocket "0.11.4"
    tslib "^2.1.0"

-"@firebase/logger@0.3.4":
-  version "0.3.4"
-  resolved "https://registry.npmjs.org/@firebase/logger/-/logger-0.3.4.tgz#8822dd3e9168be93c1bce0b4ac235e3b165a6a68"
-  integrity sha512-hlFglGRgZEwoyClZcGLx/Wd+zoLfGmbDkFx56mQt/jJ0XMbfPqwId1kiPl0zgdWZX+D8iH+gT6GuLPFsJWgiGw==
+"@firebase/logger@0.4.0":
+  version "0.4.0"
+  resolved "https://registry.npmjs.org/@firebase/logger/-/logger-0.4.0.tgz#15ecc03c452525f9d47318ad9491b81d1810f113"
+  integrity sha512-eRKSeykumZ5+cJPdxxJRgAC3G5NknY2GwEbKfymdnXtnT0Ucm4pspfR6GT4MUQEDuJwRVbVcSx85kgJulMoFFA==
  dependencies:
    tslib "^2.1.0"

-"@firebase/util@1.7.3":
-  version "1.7.3"
-  resolved "https://registry.npmjs.org/@firebase/util/-/util-1.7.3.tgz#e71640b6b2970b754f947235ceb10cba3f70e62c"
-  integrity sha512-wxNqWbqokF551WrJ9BIFouU/V5SL1oYCGx1oudcirdhadnQRFH5v1sjgGL7cUV/UsekSycygphdrF2lxBxOYKg==
+"@firebase/util@1.9.3":
+  version "1.9.3"
+  resolved "https://registry.npmjs.org/@firebase/util/-/util-1.9.3.tgz#45458dd5cd02d90e55c656e84adf6f3decf4b7ed"
+  integrity sha512-DY02CRhOZwpzO36fHpuVysz6JZrscPiBXD0fXp6qSrL9oNOx5KWICKdR95C0lSITzxp0TZosVyHqzatE8JbcjA==
  dependencies:
    tslib "^2.1.0"

-"@google-cloud/firestore@^6.4.0":
-  version "6.4.1"
-  resolved "https://registry.npmjs.org/@google-cloud/firestore/-/firestore-6.4.1.tgz#3cd32ffb10a563a9c3c91236b51e49e4cd088393"
-  integrity sha512-5q4sl1XCL8NH2y82KZ4WQGHDOPnrSMYq3JpIeKD5C0OCSb4MfckOTB9LeAQ3p5tlL+7UsVRHj0SyzKz27XZJjw==
+"@google-cloud/firestore@^6.6.0":
+  version "6.8.0"
+  resolved "https://registry.npmjs.org/@google-cloud/firestore/-/firestore-6.8.0.tgz#d8c852844c381afaf62592796606c10e178400b5"
+  integrity sha512-JRpk06SmZXLGz0pNx1x7yU3YhkUXheKgH5hbDZ4kMsdhtfV5qPLJLRI4wv69K0cZorIk+zTMOwptue7hizo0eA==
  dependencies:
    fast-deep-equal "^3.1.1"
    functional-red-black-tree "^1.0.1"
-    google-gax "^3.5.1"
-    protobufjs "^7.0.0"
+    google-gax "^3.5.7"
+    protobufjs "^7.2.5"

 "@google-cloud/paginator@^3.0.7":
  version "3.0.7"
@@ -106,10 +106,10 @@
  resolved "https://registry.npmjs.org/@google-cloud/promisify/-/promisify-3.0.1.tgz#8d724fb280f47d1ff99953aee0c1669b25238c2e"
  integrity sha512-z1CjRjtQyBOYL+5Qr9DdYIfrdLBe746jRTYfaYU6MeXkqp7UfYs/jX16lFFVzZ7PGEJvqZNqYUEtb1mvDww4pA==

-"@google-cloud/storage@^6.5.2":
-  version "6.8.0"
-  resolved "https://registry.npmjs.org/@google-cloud/storage/-/storage-6.8.0.tgz#98bf58f18d422386b245d98d0bda9054852ccd9a"
-  integrity sha512-eRGsHrhVA7NORehYW9jLUWHRzYqFxbYiG3LQL50ZhjMekDwzhPKUQ7wbjAji9OFcO3Mk8jeNHeWdpAc/QZANCg==
+"@google-cloud/storage@^6.9.5":
+  version "6.12.0"
+  resolved "https://registry.npmjs.org/@google-cloud/storage/-/storage-6.12.0.tgz#a5d3093cc075252dca5bd19a3cfda406ad3a9de1"
+  integrity sha512-78nNAY7iiZ4O/BouWMWTD/oSF2YtYgYB3GZirn0To6eBOugjXVoK+GXgUXOl+HlqbAOyHxAVXOlsj3snfbQ1dw==
  dependencies:
    "@google-cloud/paginator" "^3.0.7"
    "@google-cloud/projectify" "^3.0.0"
@@ -120,6 +120,7 @@
    duplexify "^4.0.0"
    ent "^2.2.0"
    extend "^3.0.2"
+    fast-xml-parser "^4.2.2"
    gaxios "^5.0.0"
    google-auth-library "^8.0.1"
    mime "^3.0.0"
@@ -129,10 +130,10 @@
    teeny-request "^8.0.0"
    uuid "^8.0.0"

-"@grpc/grpc-js@~1.7.0":
-  version "1.7.3"
-  resolved "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.7.3.tgz#f2ea79f65e31622d7f86d4b4c9ae38f13ccab99a"
-  integrity sha512-H9l79u4kJ2PVSxUNA08HMYAnUBLj9v6KjYQ7SQ71hOZcEXhShE/y5iQCesP8+6/Ik/7i2O0a10bPquIcYfufog==
+"@grpc/grpc-js@~1.8.0":
+  version "1.8.21"
+  resolved "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.8.21.tgz#d282b122c71227859bf6c5866f4c40f4a2696513"
+  integrity sha512-KeyQeZpxeEBSqFVTi3q2K7PiPXmgBfECc4updA1ejCLjYmoAlvvM3ZMp5ztTDUCUQmoY3CpDxvchjO1+rFkoHg==
  dependencies:
    "@grpc/proto-loader" "^0.7.0"
    "@types/node" ">=12.12.47"
@@ -148,10 +149,12 @@
    protobufjs "^7.0.0"
    yargs "^16.2.0"

-"@panva/asn1.js@^1.0.0":
-  version "1.0.0"
-  resolved "https://registry.npmjs.org/@panva/asn1.js/-/asn1.js-1.0.0.tgz#dd55ae7b8129e02049f009408b97c61ccf9032f6"
-  integrity sha512-UdkG3mLEqXgnlKsWanWcgb6dOjUzJ+XC5f+aWw30qrtjxeNUSfKX1cd5FBzOaXQumoe9nIqeZUvrRJS03HCCtw==
+"@jsdoc/salty@^0.2.1":
+  version "0.2.5"
+  resolved "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.5.tgz#1b2fa5bb8c66485b536d86eee877c263d322f692"
+  integrity sha512-TfRP53RqunNe2HBobVBJ0VLhK1HbfvBYeTC1ahnN64PWvyYyGebmMiPkuwvD9fpw2ZbkoPb8Q7mwy0aR8Z9rvw==
+  dependencies:
+    lodash "^4.17.21"

 "@protobufjs/aspromise@^1.1.1", "@protobufjs/aspromise@^1.1.2":
  version "1.1.2"
@@ -240,14 +243,15 @@
    "@types/qs" "*"
    "@types/range-parser" "*"

-"@types/express-serve-static-core@^4.17.31":
-  version "4.17.31"
-  resolved "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.31.tgz#a1139efeab4e7323834bb0226e62ac019f474b2f"
-  integrity sha512-DxMhY+NAsTwMMFHBTtJFNp5qiHKJ7TeqOo23zVEM9alT1Ml27Q3xcTH0xwxn7Q0BbMcVEJOs/7aQtUWupUQN3Q==
+"@types/express-serve-static-core@^4.17.33":
+  version "4.17.39"
+  resolved "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.39.tgz#2107afc0a4b035e6cb00accac3bdf2d76ae408c8"
+  integrity sha512-BiEUfAiGCOllomsRAZOiMFP7LAnrifHpt56pc4Z7l9K6ACyN06Ns1JLMBxwkfLOjJRlSf06NwWsT7yzfpaVpyQ==
  dependencies:
    "@types/node" "*"
    "@types/qs" "*"
    "@types/range-parser" "*"
+    "@types/send" "*"

 "@types/[email protected]":
  version "4.17.3"
@@ -258,20 +262,28 @@
    "@types/express-serve-static-core" "*"
    "@types/serve-static" "*"

-"@types/express@^4.17.14":
-  version "4.17.15"
-  resolved "https://registry.npmjs.org/@types/express/-/express-4.17.15.tgz#9290e983ec8b054b65a5abccb610411953d417ff"
-  integrity sha512-Yv0k4bXGOH+8a+7bELd2PqHQsuiANB+A8a4gnQrkRWzrkKlb6KHaVvyXhqs04sVW/OWlbPyYxRgYlIXLfrufMQ==
+"@types/express@^4.17.17":
+  version "4.17.20"
+  resolved "https://registry.npmjs.org/@types/express/-/express-4.17.20.tgz#e7c9b40276d29e38a4e3564d7a3d65911e2aa433"
+  integrity sha512-rOaqlkgEvOW495xErXMsmyX3WKBInbhG5eqojXYi3cGUaLoRDlXa5d52fkfWZT963AZ3v2eZ4MbKE6WpDAGVsw==
  dependencies:
    "@types/body-parser" "*"
-    "@types/express-serve-static-core" "^4.17.31"
+    "@types/express-serve-static-core" "^4.17.33"
    "@types/qs" "*"
    "@types/serve-static" "*"

-"@types/jsonwebtoken@^8.5.9":
-  version "8.5.9"
-  resolved "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-8.5.9.tgz#2c064ecb0b3128d837d2764aa0b117b0ff6e4586"
-  integrity sha512-272FMnFGzAVMGtu9tkr29hRL6bZj4Zs1KZNeHLnKqAvp06tAIcarTMwOh8/8bz4FmKRcMxZhZNeUAQsNLoiPhg==
+"@types/glob@*":
+  version "8.1.0"
+  resolved "https://registry.npmjs.org/@types/glob/-/glob-8.1.0.tgz#b63e70155391b0584dce44e7ea25190bbc38f2fc"
+  integrity sha512-IO+MJPVhoqz+28h1qLAcBEH2+xHMK6MTyHJc7MTnnYb6wsoLR29POVGJ7LycmVXIqyy/4/2ShP5sUwTXuOwb/w==
+  dependencies:
+    "@types/minimatch" "^5.1.2"
+    "@types/node" "*"
+
+"@types/jsonwebtoken@^9.0.2":
+  version "9.0.4"
+  resolved "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.4.tgz#8b74bbe87bde81a3469d4b32a80609bec62c23ec"
+  integrity sha512-8UYapdmR0QlxgvJmyE8lP7guxD0UGVMfknsdtCFZh4ovShdBl3iOI4zdvqBHrB/IS+xUj3PSx73Qkey1fhWz+g==
  dependencies:
    "@types/node" "*"

@@ -303,6 +315,11 @@
  resolved "https://registry.npmjs.org/@types/mime/-/mime-1.3.2.tgz#93e25bf9ee75fe0fd80b594bc4feb0e862111b5a"
  integrity sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==

+"@types/minimatch@^5.1.2":
+  version "5.1.2"
+  resolved "https://registry.npmjs.org/@types/minimatch/-/minimatch-5.1.2.tgz#07508b45797cb81ec3f273011b054cd0755eddca"
+  integrity sha512-K0VQKziLUWkVKiRVrx4a40iPaxTUefQmjtkQofBkYRcoaaL/8rhwDWww9qWbrgicNOgnpIsMxyNIUM4+n6dUIA==
+
 "@types/node@*", "@types/node@>=12.12.47", "@types/node@>=13.7.0":
  version "16.9.6"
  resolved "https://registry.npmjs.org/@types/node/-/node-16.9.6.tgz#040a64d7faf9e5d9e940357125f0963012e66f04"
@@ -318,6 +335,22 @@
  resolved "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.4.tgz#cd667bcfdd025213aafb7ca5915a932590acdcdc"
  integrity sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==

+"@types/rimraf@^3.0.2":
+  version "3.0.2"
+  resolved "https://registry.npmjs.org/@types/rimraf/-/rimraf-3.0.2.tgz#a63d175b331748e5220ad48c901d7bbf1f44eef8"
+  integrity sha512-F3OznnSLAUxFrCEu/L5PY8+ny8DtcFRjx7fZZ9bycvXRi3KPTRS9HOitGZwvPg0juRhXFWIeKX58cnX5YqLohQ==
+  dependencies:
+    "@types/glob" "*"
+    "@types/node" "*"
+
+"@types/send@*":
+  version "0.17.3"
+  resolved "https://registry.npmjs.org/@types/send/-/send-0.17.3.tgz#81b2ea5a3a18aad357405af2d643ccbe5a09020b"
+  integrity sha512-/7fKxvKUoETxjFUsuFlPB9YndePpxxRAOfGC/yJdc9kTjTeP5kRCTzfnE8kPUKCeyiyIZu0YQ76s50hCedI1ug==
+  dependencies:
+    "@types/mime" "^1"
+    "@types/node" "*"
+
 "@types/serve-static@*":
  version "1.13.10"
  resolved "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.13.10.tgz#f5e0ce8797d2d7cc5ebeda48a52c96c4fa47a8d9"
@@ -743,6 +776,13 @@ fast-text-encoding@^1.0.0, fast-text-encoding@^1.0.3:
  resolved "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.3.tgz#ec02ac8e01ab8a319af182dae2681213cfe9ce53"
  integrity sha512-dtm4QZH9nZtcDt8qJiOH9fcQd1NAgi+K1O2DbE6GG1PPCK/BWfOH3idCTRQ4ImXRUOyopDEgDEnVEE7Y/2Wrig==

+fast-xml-parser@^4.2.2:
+  version "4.3.2"
+  resolved "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.3.2.tgz#761e641260706d6e13251c4ef8e3f5694d4b0d79"
+  integrity sha512-rmrXUXwbJedoXkStenj1kkljNF7ugn5ZjR9FJcwmCfcCbtOMDghPajbc+Tck6vE6F5XsDmx+Pr2le9fw8+pXBg==
+  dependencies:
+    strnum "^1.0.5"
+
 [email protected]:
  version "0.11.4"
  resolved "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz#7f0d9275cfdd86a1c963dc8b65fcc451edcbb1da"
@@ -763,22 +803,22 @@ finalhandler@~1.1.2:
    statuses "~1.5.0"
    unpipe "~1.0.0"

-firebase-admin@11.3.0:
-  version "11.3.0"
-  resolved "https://registry.npmjs.org/firebase-admin/-/firebase-admin-11.3.0.tgz#0c80a47d85471f6b988ecef7439a706aca052b88"
-  integrity sha512-8ENXUu9Lm6YTc5zzOqlF222M/KwsV/EDZ5UwwPPEU5XfCa1Ebj7K/SgLFdinjGu1NxkSnqu07UDpPhmAtW3b5w==
+firebase-admin@11.10.1:
+  version "11.10.1"
+  resolved "https://registry.npmjs.org/firebase-admin/-/firebase-admin-11.10.1.tgz#5f0f83a44627e89938d350c5e4bbac76596c963e"
+  integrity sha512-atv1E6GbuvcvWaD3eHwrjeP5dAVs+EaHEJhu9CThMzPY6In8QYDiUR6tq5SwGl4SdA/GcAU0nhwWc/FSJsAzfQ==
  dependencies:
-    "@fastify/busboy" "^1.1.0"
-    "@firebase/database-compat" "^0.2.6"
-    "@firebase/database-types" "^0.9.13"
+    "@fastify/busboy" "^1.2.1"
+    "@firebase/database-compat" "^0.3.4"
+    "@firebase/database-types" "^0.10.4"
    "@types/node" ">=12.12.47"
-    jsonwebtoken "^8.5.1"
-    jwks-rsa "^2.1.4"
+    jsonwebtoken "^9.0.0"
+    jwks-rsa "^3.0.1"
    node-forge "^1.3.1"
    uuid "^9.0.0"
  optionalDependencies:
-    "@google-cloud/firestore" "^6.4.0"
-    "@google-cloud/storage" "^6.5.2"
+    "@google-cloud/firestore" "^6.6.0"
+    "@google-cloud/storage" "^6.9.5"

 [email protected]:
  version "3.24.1"
@@ -888,14 +928,15 @@ google-auth-library@^8.0.2:
    jws "^4.0.0"
    lru-cache "^6.0.0"

-google-gax@^3.5.1:
-  version "3.5.2"
-  resolved "https://registry.npmjs.org/google-gax/-/google-gax-3.5.2.tgz#7c3ad61dbf366a55527b803caead276668b160d8"
-  integrity sha512-AyP53w0gHcWlzxm+jSgqCR3Xu4Ld7EpSjhtNBnNhzwwWaIUyphH9kBGNIEH+i4UGkTUXOY29K/Re8EiAvkBRGw==
+google-gax@^3.5.7:
+  version "3.6.1"
+  resolved "https://registry.npmjs.org/google-gax/-/google-gax-3.6.1.tgz#02c78fc496f5adf86f2ca9145545f4b6575f6118"
+  integrity sha512-g/lcUjGcB6DSw2HxgEmCDOrI/CByOwqRvsuUvNalHUK2iPPPlmAIpbMbl62u0YufGMr8zgE3JL7th6dCb1Ry+w==
  dependencies:
-    "@grpc/grpc-js" "~1.7.0"
+    "@grpc/grpc-js" "~1.8.0"
    "@grpc/proto-loader" "^0.7.0"
    "@types/long" "^4.0.0"
+    "@types/rimraf" "^3.0.2"
    abort-controller "^3.0.0"
    duplexify "^4.0.0"
    fast-text-encoding "^1.0.3"
@@ -904,8 +945,8 @@ google-gax@^3.5.1:
    node-fetch "^2.6.1"
    object-hash "^3.0.0"
    proto3-json-serializer "^1.0.0"
-    protobufjs "7.1.2"
-    protobufjs-cli "1.0.2"
+    protobufjs "7.2.4"
+    protobufjs-cli "1.1.1"
    retry-request "^5.0.0"

 google-p12-pem@^4.0.0:
@@ -1023,12 +1064,10 @@ is-stream@^2.0.0:
  resolved "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz#fac1e3d53b97ad5a9d0ae9cef2389f5810a5c077"
  integrity sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==

-jose@^2.0.6:
-  version "2.0.6"
-  resolved "https://registry.npmjs.org/jose/-/jose-2.0.6.tgz#894ba19169af339d3911be933f913dd02fc57c7c"
-  integrity sha512-FVoPY7SflDodE4lknJmbAHSUjLCzE2H1F6MS0RYKMQ8SR+lNccpMf8R4eqkNYyyUjR5qZReOzZo5C5YiHOCjjg==
-  dependencies:
-    "@panva/asn1.js" "^1.0.0"
+jose@^4.14.6:
+  version "4.15.4"
+  resolved "https://registry.npmjs.org/jose/-/jose-4.15.4.tgz#02a9a763803e3872cf55f29ecef0dfdcc218cc03"
+  integrity sha512-W+oqK4H+r5sITxfxpSU+MMdr/YSWGvgZMQDIsNoBDGGy4i7GBPTtvFKibQzW06n3U3TqHjhvBJsirShsEJ6eeQ==

 js2xmlparser@^4.0.2:
  version "4.0.2"
@@ -1037,12 +1076,13 @@ js2xmlparser@^4.0.2:
  dependencies:
    xmlcreate "^2.0.4"

-jsdoc@^3.6.3:
-  version "3.6.11"
-  resolved "https://registry.npmjs.org/jsdoc/-/jsdoc-3.6.11.tgz#8bbb5747e6f579f141a5238cbad4e95e004458ce"
-  integrity sha512-8UCU0TYeIYD9KeLzEcAu2q8N/mx9O3phAGl32nmHlE0LpaJL71mMkP4d+QE5zWfNt50qheHtOZ0qoxVrsX5TUg==
+jsdoc@^4.0.0:
+  version "4.0.2"
+  resolved "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.2.tgz#a1273beba964cf433ddf7a70c23fd02c3c60296e"
+  integrity sha512-e8cIg2z62InH7azBBi3EsSEqrKx+nUtAS5bBcYTSpZFA+vhNPyhv8PTFZ0WsjOPDj04/dOLlm08EDcQJDqaGQg==
  dependencies:
-    "@babel/parser" "^7.9.4"
+    "@babel/parser" "^7.20.15"
+    "@jsdoc/salty" "^0.2.1"
    "@types/markdown-it" "^12.2.3"
    bluebird "^3.7.2"
    catharsis "^0.9.0"
@@ -1055,7 +1095,6 @@ jsdoc@^3.6.3:
    mkdirp "^1.0.4"
    requizzle "^0.2.3"
    strip-json-comments "^3.1.0"
-    taffydb "2.6.2"
    underscore "~1.13.2"

 json-bigint@^1.0.0:
@@ -1065,10 +1104,10 @@ json-bigint@^1.0.0:
  dependencies:
    bignumber.js "^9.0.0"

-jsonwebtoken@^8.5.1:
-  version "8.5.1"
-  resolved "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz#00e71e0b8df54c2121a1f26137df2280673bcc0d"
-  integrity sha512-XjwVfRS6jTMsqYs0EsuJ4LGxXV14zQybNd4L2r0UvbVnSF9Af8x7p5MzbJ90Ioz/9TI41/hTCvznF/loiSzn8w==
+jsonwebtoken@^9.0.0:
+  version "9.0.2"
+  resolved "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.2.tgz#65ff91f4abef1784697d40952bb1998c504caaf3"
+  integrity sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==
  dependencies:
    jws "^3.2.2"
    lodash.includes "^4.3.0"
@@ -1079,7 +1118,7 @@ jsonwebtoken@^8.5.1:
    lodash.isstring "^4.0.1"
    lodash.once "^4.0.0"
    ms "^2.1.1"
-    semver "^5.6.0"
+    semver "^7.5.4"

 jwa@^1.4.1:
  version "1.4.1"
@@ -1099,17 +1138,17 @@ jwa@^2.0.0:
    ecdsa-sig-formatter "1.0.11"
    safe-buffer "^5.0.1"

-jwks-rsa@^2.1.4:
-  version "2.1.5"
-  resolved "https://registry.npmjs.org/jwks-rsa/-/jwks-rsa-2.1.5.tgz#bb7bf8c5767836bc273bf5b27870066aca39c1bb"
-  integrity sha512-IODtn1SwEm7n6GQZnQLY0oxKDrMh7n/jRH1MzE8mlxWMrh2NnMyOsXTebu8vJ1qCpmuTJcL4DdiE0E4h8jnwsA==
+jwks-rsa@^3.0.1:
+  version "3.1.0"
+  resolved "https://registry.npmjs.org/jwks-rsa/-/jwks-rsa-3.1.0.tgz#50406f23e38c9b2682cd437f824d7d61aa983171"
+  integrity sha512-v7nqlfezb9YfHHzYII3ef2a2j1XnGeSE/bK3WfumaYCqONAIstJbrEGapz4kadScZzEt7zYCN7bucj8C0Mv/Rg==
  dependencies:
-    "@types/express" "^4.17.14"
-    "@types/jsonwebtoken" "^8.5.9"
+    "@types/express" "^4.17.17"
+    "@types/jsonwebtoken" "^9.0.2"
    debug "^4.3.4"
-    jose "^2.0.6"
+    jose "^4.14.6"
    limiter "^1.1.5"
-    lru-memoizer "^2.1.4"
+    lru-memoizer "^2.2.0"

 jws@^3.2.2:
  version "3.2.2"
@@ -1229,10 +1268,10 @@ lru-cache@~4.0.0:
    pseudomap "^1.0.1"
    yallist "^2.0.0"

-lru-memoizer@^2.1.4:
-  version "2.1.4"
-  resolved "https://registry.npmjs.org/lru-memoizer/-/lru-memoizer-2.1.4.tgz#b864d92b557f00b1eeb322156a0409cb06dafac6"
-  integrity sha512-IXAq50s4qwrOBrXJklY+KhgZF+5y98PDaNo0gi/v2KQBFLyWr+JyFvijZXkGKjQj/h9c0OwoE+JZbwUXce76hQ==
+lru-memoizer@^2.2.0:
+  version "2.2.0"
+  resolved "https://registry.npmjs.org/lru-memoizer/-/lru-memoizer-2.2.0.tgz#b9d90c91637b4b1a423ef76f3156566691293df8"
+  integrity sha512-QfOZ6jNkxCcM/BkIPnFsqDhtrazLRsghi9mBwFAzol5GCvj4EkFT899Za3+QwikCg5sRX8JstioBDwOxEyzaNw==
  dependencies:
    lodash.clonedeep "^4.5.0"
    lru-cache "~4.0.0"
@@ -1443,23 +1482,41 @@ proto3-json-serializer@^1.0.0:
  dependencies:
    protobufjs "^7.0.0"

-protobufjs-cli@1.0.2:
-  version "1.0.2"
-  resolved "https://registry.npmjs.org/protobufjs-cli/-/protobufjs-cli-1.0.2.tgz#905fc49007cf4aaf3c45d5f250eb294eedeea062"
-  integrity sha512-cz9Pq9p/Zs7okc6avH20W7QuyjTclwJPgqXG11jNaulfS3nbVisID8rC+prfgq0gbZE0w9LBFd1OKFF03kgFzg==
+protobufjs-cli@1.1.1:
+  version "1.1.1"
+  resolved "https://registry.npmjs.org/protobufjs-cli/-/protobufjs-cli-1.1.1.tgz#f531201b1c8c7772066aa822bf9a08318b24a704"
+  integrity sha512-VPWMgIcRNyQwWUv8OLPyGQ/0lQY/QTQAVN5fh+XzfDwsVw1FZ2L3DM/bcBf8WPiRz2tNpaov9lPZfNcmNo6LXA==
  dependencies:
    chalk "^4.0.0"
    escodegen "^1.13.0"
    espree "^9.0.0"
    estraverse "^5.1.0"
    glob "^8.0.0"
-    jsdoc "^3.6.3"
+    jsdoc "^4.0.0"
    minimist "^1.2.0"
    semver "^7.1.2"
    tmp "^0.2.1"
    uglify-js "^3.7.7"

-protobufjs@7.1.2, protobufjs@^7.0.0:
+protobufjs@7.2.4:
+  version "7.2.4"
+  resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.4.tgz#3fc1ec0cdc89dd91aef9ba6037ba07408485c3ae"
+  integrity sha512-AT+RJgD2sH8phPmCf7OUZR8xGdcJRga4+1cOaXJ64hvcSkVhNcRHOwIxUatPH15+nj59WAGTDv3LSGZPEQbJaQ==
+  dependencies:
+    "@protobufjs/aspromise" "^1.1.2"
+    "@protobufjs/base64" "^1.1.2"
+    "@protobufjs/codegen" "^2.0.4"
+    "@protobufjs/eventemitter" "^1.1.0"
+    "@protobufjs/fetch" "^1.1.0"
+    "@protobufjs/float" "^1.0.2"
+    "@protobufjs/inquire" "^1.1.0"
+    "@protobufjs/path" "^1.1.2"
+    "@protobufjs/pool" "^1.1.0"
+    "@protobufjs/utf8" "^1.1.0"
+    "@types/node" ">=13.7.0"
+    long "^5.0.0"
+
+protobufjs@^7.0.0:
  version "7.1.2"
  resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.1.2.tgz#a0cf6aeaf82f5625bffcf5a38b7cd2a7de05890c"
  integrity sha512-4ZPTPkXCdel3+L81yw3dG6+Kq3umdWKh7Dc7GW/CpNk4SX3hK58iPCWeCyhVTDrbkNeKrYNZ7EojM5WDaEWTLQ==
@@ -1477,6 +1534,24 @@ [email protected], protobufjs@^7.0.0:
    "@types/node" ">=13.7.0"
    long "^5.0.0"

+protobufjs@^7.2.5:
+  version "7.2.5"
+  resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.5.tgz#45d5c57387a6d29a17aab6846dcc283f9b8e7f2d"
+  integrity sha512-gGXRSXvxQ7UiPgfw8gevrfRWcTlSbOFg+p/N+JVJEK5VhueL2miT6qTymqAmjr1Q5WbOCyJbyrk6JfWKwlFn6A==
+  dependencies:
+    "@protobufjs/aspromise" "^1.1.2"
+    "@protobufjs/base64" "^1.1.2"
+    "@protobufjs/codegen" "^2.0.4"
+    "@protobufjs/eventemitter" "^1.1.0"
+    "@protobufjs/fetch" "^1.1.0"
+    "@protobufjs/float" "^1.0.2"
+    "@protobufjs/inquire" "^1.1.0"
+    "@protobufjs/path" "^1.1.2"
+    "@protobufjs/pool" "^1.1.0"
+    "@protobufjs/utf8" "^1.1.0"
+    "@types/node" ">=13.7.0"
+    long "^5.0.0"
+
 proxy-addr@~2.0.5:
  version "2.0.7"
  resolved "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz#f19fe69ceab311eeb94b42e70e8c2070f9ba1025"
@@ -1566,11 +1641,6 @@ safe-buffer@>=5.1.0, safe-buffer@^5.0.1, safe-buffer@~5.2.0:
  resolved "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
  integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==

-semver@^5.6.0:
-  version "5.7.1"
-  resolved "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7"
-  integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==
-
 semver@^7.1.2:
  version "7.3.8"
  resolved "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz#07a78feafb3f7b32347d725e33de7e2a2df67798"
@@ -1578,6 +1648,13 @@ semver@^7.1.2:
  dependencies:
    lru-cache "^6.0.0"

+semver@^7.5.4:
+  version "7.5.4"
+  resolved "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz#483986ec4ed38e1c6c48c34894a9182dbff68a6e"
+  integrity sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==
+  dependencies:
+    lru-cache "^6.0.0"
+
 [email protected]:
  version "0.17.1"
  resolved "https://registry.npmjs.org/send/-/send-0.17.1.tgz#c1d8b059f7900f7466dd4938bdc44e11ddb376c8"
@@ -1662,6 +1739,11 @@ strip-json-comments@^3.1.0:
  resolved "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz#31f1281b3832630434831c310c01cccda8cbe006"
  integrity sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==

+strnum@^1.0.5:
+  version "1.0.5"
+  resolved "https://registry.npmjs.org/strnum/-/strnum-1.0.5.tgz#5c4e829fe15ad4ff0d20c3db5ac97b73c9b072db"
+  integrity sha512-J8bbNyKKXl5qYcR36TIO8W3mVGVHrmmxsd5PAItGkmyzwJvybiw2IVq5nqd0i4LSNSkB/sx9VHllbfFdr9k1JA==
+
 stubs@^3.0.0:
  version "3.0.0"
  resolved "https://registry.npmjs.org/stubs/-/stubs-3.0.0.tgz#e8d2ba1fa9c90570303c030b6900f7d5f89abe5b"
@@ -1674,11 +1756,6 @@ supports-color@^7.1.0:
  dependencies:
    has-flag "^4.0.0"

-[email protected]:
-  version "2.6.2"
-  resolved "https://registry.npmjs.org/taffydb/-/taffydb-2.6.2.tgz#7cbcb64b5a141b6a2efc2c5d2c67b4e150b2a268"
-  integrity sha512-y3JaeRSplks6NYQuCOj3ZFMO3j60rTwbuKCvZxsAraGYH2epusatvZ0baZYA01WsGqJBq/Dl6vOrMUJqyMj8kA==
-
 teeny-request@^8.0.0:
  version "8.0.2"
  resolved "https://registry.npmjs.org/teeny-request/-/teeny-request-8.0.2.tgz#c06a75101cf782788ba8f9a2ed5f2ac84c1c4e15"
@@ -54,6 +54,7 @@
    "url": "https://github.com/firebase/firebase-js-sdk/issues"
  },
  "dependencies": {
-    "node-fetch": "2.6.7"
+    "node-fetch": "2.6.7",
+    "@types/node-fetch": "2.6.4"
  }
 }
@@ -48,7 +48,7 @@
  "dependencies": {
    "@firebase/util": "1.9.3",
    "@firebase/component": "0.6.4",
-    "node-fetch": "2.6.7",
+    "undici": "5.26.5",
    "tslib": "^2.1.0"
  },
  "peerDependencies": {
@@ -15,7 +15,6 @@
 * limitations under the License.
 */

-import { isNode } from '@firebase/util';
 import { invalidArgument } from './error';

 export function isJustDef<T>(p: T | null | undefined): p is T | null {
@@ -40,9 +39,7 @@ export function isNativeBlob(p: unknown): p is Blob {
 }

 export function isNativeBlobDefined(): boolean {
-  // Note: The `isNode()` check can be removed when `node-fetch` adds native Blob support
-  // PR: https://github.com/node-fetch/node-fetch/pull/1664
-  return typeof Blob !== 'undefined' && !isNode();
+  return typeof Blob !== 'undefined';
 }

 export function validateNumber(
@@ -21,7 +21,7 @@ import {
  ErrorCode
 } from '../../implementation/connection';
 import { internalError } from '../../implementation/error';
-import nodeFetch, { Headers } from 'node-fetch';
+import { fetch as undiciFetch, Headers as undiciHeaders } from 'undici';

 /** An override for the text-based Connection. Used in tests. */
 let textFactoryOverride: (() => Connection<string>) | null = null;
@@ -39,9 +39,9 @@ abstract class FetchConnection<T extends ConnectionType>
  protected statusCode_: number | undefined;
  protected body_: ArrayBuffer | undefined;
  protected errorText_ = '';
-  protected headers_: Headers | undefined;
+  protected headers_: undiciHeaders | undefined;
  protected sent_: boolean = false;
-  protected fetch_ = nodeFetch;
+  protected fetch_ = undiciFetch;

  constructor() {
    this.errorCode_ = ErrorCode.NO_ERROR;
@@ -17,7 +17,7 @@

 import { ChangelogFunctions } from '@changesets/types';
 import { getInfo } from '@changesets/get-github-info';
-import fetch from 'node-fetch';
+import { fetch as undiciFetch, Response as undiciResponse } from 'undici';

 const changelogFunctions: ChangelogFunctions = {
  getDependencyReleaseLine: async (
@@ -95,7 +95,7 @@ async function getFixedIssueLink(
  prNumber: number,
  repo: string
 ): Promise<string> {
-  const { body }: { body: string } = await fetch(
+  const response = await undiciFetch(
    `https://api.github.com/repos/${repo}/pulls/${prNumber}`,
    {
      method: 'GET',
@@ -105,7 +105,11 @@ async function getFixedIssueLink(
    }
  ).then(data => data.json());

-  const match = fixedIssueRegex.exec(body);
+  const body = (response as undiciResponse).body;
+  if (!body) {
+    return '';
+  }
+  const match = fixedIssueRegex.exec(body.toString());
  if (!match) {
    return '';
  }
@@ -2,6 +2,7 @@
  "name": "@firebase/changelog-generator",
  "version": "0.1.0",
  "private": true,
+  "type": "commonjs",
  "description": "A package for generating changelog",
  "author": "Firebase <[email protected]> (https://firebase.google.com/)",
  "main": "dist/index.js",
@@ -18,8 +19,8 @@
  "dependencies": {
    "@changesets/types": "3.3.0",
    "@changesets/get-github-info": "0.5.2",
-    "node-fetch": "2.6.7",
-    "@types/node-fetch": "2.6.4"
+    "@types/node": "20.8.10",
+    "undici": "5.26.5"
  },
  "license": "Apache-2.0",
  "devDependencies": {
@@ -9,9 +9,6 @@
    "moduleResolution": "node",
    "esModuleInterop": true,
    "resolveJsonModule": true,
-    "target": "es5",
-    "typeRoots": [
-      "../../node_modules/@types"
-    ]
+    "target": "es5"
  }
 }
@@ -1653,6 +1653,11 @@
    minimatch "^3.0.4"
    strip-json-comments "^3.1.1"

+"@fastify/busboy@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.0.0.tgz#f22824caff3ae506b18207bad4126dbc6ccdb6b8"
+  integrity sha512-JUFJad5lv7jxj926GPgymrWQxxjPYuJNiNjNMzqT+HiuP6Vl3dk5xzG+8sTX96np0ZAluvaMzPsjhHZ5rNuNQQ==
+
 "@gar/promisify@^1.0.1":
  version "1.1.2"
  resolved "https://registry.npmjs.org/@gar/promisify/-/promisify-1.1.2.tgz#30aa825f11d438671d585bd44e7fd564535fc210"
@@ -3489,6 +3494,13 @@
  resolved "https://registry.npmjs.org/@types/node/-/node-12.20.50.tgz#14ba5198f1754ffd0472a2f84ab433b45ee0b65e"
  integrity sha512-+9axpWx2b2JCVovr7Ilgt96uc6C1zBKOQMpGtRbWT9IoR/8ue32GGMfGA4woP8QyP2gBs6GQWEVM3tCybGCxDA==

+"@types/[email protected]":
+  version "20.8.10"
+  resolved "https://registry.npmjs.org/@types/node/-/node-20.8.10.tgz#a5448b895c753ae929c26ce85cab557c6d4a365e"
+  integrity sha512-TlgT8JntpcbmKUFzjhsyhGfP2fsiz1Mv56im6enJ905xG1DAYesxJaeSbGqQmAw8OWPdhyJGhGSQGKRNJ45u9w==
+  dependencies:
+    undici-types "~5.26.4"
+
 "@types/normalize-package-data@^2.4.0":
  version "2.4.1"
  resolved "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.1.tgz#d3357479a0fdfdd5907fe67e17e0a85c906e1301"
@@ -16909,6 +16921,18 @@ undertaker@^1.2.1:
    object.reduce "^1.0.0"
    undertaker-registry "^1.0.0"

+undici-types@~5.26.4:
+  version "5.26.5"
+  resolved "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz#bcd539893d00b56e964fd2657a4866b221a65617"
+  integrity sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==
+
+[email protected]:
+  version "5.26.5"
+  resolved "https://registry.npmjs.org/undici/-/undici-5.26.5.tgz#f6dc8c565e3cad8c4475b187f51a13e505092838"
+  integrity sha512-cSb4bPFd5qgR7qr2jYAi0hlX9n5YKK2ONKkLFkxl+v/9BvC0sOpZjBHDBSXc5lWAf5ty9oZdRXytBIHzgUcerw==
+  dependencies:
+    "@fastify/busboy" "^2.0.0"
+
 unicode-canonical-property-names-ecmascript@^2.0.0:
  version "2.0.0"
  resolved "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz#301acdc525631670d39f6146e0e77ff6bbdebddc"