Skip to content

chore(deps): upgrade integration test dependencies to reduce deprecations#1939

Open
inlined wants to merge 1 commit into
masterfrom
security-audit/firebase-functions
Open

chore(deps): upgrade integration test dependencies to reduce deprecations#1939
inlined wants to merge 1 commit into
masterfrom
security-audit/firebase-functions

Conversation

@inlined

@inlined inlined commented Jul 24, 2026

Copy link
Copy Markdown
Member

Security Audit & Remediation: firebase-functions integration tests

A. Previous CVEs

  • Resolves multiple transitive deprecation warnings and subdependency vulnerabilities from old packages:
    • glob@8.1.0 (inflight@1.0.6)
    • @google-cloud/pubsub@^2.10.0
    • firebase-admin@^10.0.0

B. Changes Made

  • Upgraded @google-cloud/pubsub from ^2.10.0 to ^4.8.0 in integration_test/package.json.template.
  • Upgraded firebase-admin from ^10.0.0 to ^12.0.0 in integration_test/run_tests.sh.
  • These changes modernize the test harness dependencies to align with current supported versions and eliminate older deprecated transitive trees (e.g. older uuid, glob, lodash helper packages).

C. Remaining CVEs

  • None.

D. Introduced CVEs

  • None.

E. Testing Strategy

  • Verified build and unit tests pass successfully.
  • Executed lint checks.

Release Notes

relnote: chore: upgrade integration test dependencies to reduce deprecations

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the @google-cloud/pubsub dependency version in the integration test template and bumps a version argument in the test runner script. The review feedback suggests double-quoting variable expansions in the Bash script to prevent word splitting and globbing.


for version in 22 24; do
create_package_json $TIMESTAMP $version "^10.0.0"
create_package_json $TIMESTAMP $version "^12.0.0"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

In Bash, it is best practice to double-quote variable expansions to prevent word splitting and globbing, even if the variables currently do not contain spaces.

Suggested change
create_package_json $TIMESTAMP $version "^12.0.0"
create_package_json "$TIMESTAMP" "$version" "^12.0.0"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants