chore(deps): resolve pipeline deprecations and upgrade dependencies

[inlined]

Security Audit & Remediation: firebase-functions

A. Previous CVEs

• GHSA-v422-hmwv-36x6 - body-parser (Severity: High)
• GHSA-3jxr-9vmj-r5cp - brace-expansion (Severity: High)
• GHSA-mh29-5h37-fv8m - js-yaml (Severity: High)
• GHSA-v245-v573-v5vm - linkify-it (Severity: High)
• GHSA-c2qf-rxjj-qqgw - semver (Severity: High)
• GHSA-5c6j-r48x-rmvq - serialize-javascript (Severity: High)
• GHSA-w5hq-g745-h8pq - uuid (Severity: Moderate)
• GHSA-qgmg-gppg-76g5 - validator (Severity: High)
• GHSA-8r6m-32jq-jx6q - fast-xml-parser (Severity: High) (Resolved)
• GHSA-v2hh-gcrm-f6hx - fast-uri (Severity: High) (Resolved)

B. Changes Made

• Removed unused jsdom dependency from devDependencies in package.json. This completely eliminated multiple deprecated transitive warnings in the pipeline (whatwg-encoding@1.0.5, w3c-hr-time@1.0.2, abab@2.0.6, domexception@2.0.1, and node-domexception@1.0.0) and removed associated vulnerabilities.
• Upgraded mocha to ^11.7.6 to resolve the deprecation of glob@8.1.0 and inflight@1.0.6 by using glob 10+.
• Upgraded sinon to ^22.1.0 and @types/sinon to ^22.0.0 to resolve deprecation warnings of sinon@9 and its transitive dependencies (lodash.get and @sinonjs/text-encoding).
• Upgraded protobufjs-cli to ^1.3.3 to modernize transitively resolved dependencies while maintaining compatibility with the production protobufjs@7 dependency and retaining the caret (^) versioning constraint.
• Upgraded express to ^5.2.1 and @types/express to ^5.0.0 in dependencies in package.json.
• Added overrides in package.json to link @as-integrations/express4's peer dependency to Express 5 for local development and testing.
• Patched spec/v2/providers/https.spec.ts to add a type cast (as any) resolving Express 5 handler type checks without modifying spec/helper.ts.

C. Express 5 & Peer Dependency Nuance

• Express 5 Upgrade: Upgraded express to v5 to align with @google-cloud/functions-framework@^5.0.0, which now runs Express 5 in production environments. This prevents duplicate dependency installs and runtime instanceof/prototype mismatch issues.
• Peer Dependency Bridge: To maintain backward compatibility and avoid breaking changes for existing users, we have kept @as-integrations/express4 as the optional peer dependency. We resolve the installation mismatch locally during development and CI using the overrides field in package.json.
• Future Roadmap: The optional peer dependency should be migrated to @as-integrations/express5 in the next major version of the SDK.

D. Remaining CVEs

• uuid@<11.1.1 (transitive via @genkit-ai/ai / genkit / firebase-admin / googleapis): Upstream dependencies have not fully migrated to uuid v11 in their current major versions.
• js-yaml@4 (transitive via @firebase/api-documenter): Part of the documentation generation tooling.
• semver@7 (transitive via @rushstack/node-core-library): Used by API Documenter and Extractor.
• validator (transitive via z-schema): Used by @rushstack/node-core-library.

E. Introduced CVEs

• None.

F. Testing Strategy

• Ran the unit test suite via npm test — 100% passing (all 973 unit tests).
• Executed package build via npm run build — compiled successfully.
• Conducted post-remediation dependency analysis using npm audit.

Release Notes

relnote: chore: update dependencies to close CVEs

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[inlined]

We need to update @as-integrations/express4 to @as-integrations/express5 in the next major version of the SDK to fully close any transitive peer dependency issues/vulnerabilities.