fix(deps): resolve npm audit advisories in root and functions lockfiles

[YasunoriMATSUOKA]

Summary

Runs npm audit fix against both packages in this repo (root React/Vite app and functions/) and commits the resulting lockfiles.

Only package-lock.json and functions/package-lock.json change. No package.json edits, no new overrides: every update landed inside a semver range that was already declared, so no dependency contract is loosened and nothing is forced across a declared major.

Package	Before	After
root	19 (1 critical, 10 high, 7 moderate, 1 low)	3 moderate
functions/	8 (4 high, 3 moderate, 1 low)	2 moderate

GitHub currently reports 69 open Dependabot alerts on main (26 high, 39 moderate, 4 low); this closes all of them except the two residual advisories described below.

What moved

Root — tar 7.5.16 → 7.5.22 (the only critical: GHSA-w8wr-v893-vjvp and 4 more), react-router / react-router-dom 7.17.0 → 7.18.2, postcss 8.5.15 → 8.5.26, undici 6.26.0 → 6.28.0, js-yaml 4.2.0 → 4.3.1, hono 4.12.24 → 4.13.2, @hono/node-server 1.19.14 → 1.19.17, ip-address 10.2.0 → 10.5.0, fast-uri 3.1.2 → 3.1.5, form-data 4.0.5 → 4.0.6, re2 1.24.1 → 1.26.1, protobufjs 7.6.2 → 7.6.5, nanoid 3.3.12 → 3.3.18, body-parser 1.20.5 → 1.20.6, and brace-expansion across every nested tree.

firebase-tools also moves 15.19.1 → 15.27.0 (devDependency, within ^15.19.1). The ws 7.5.11 → 8.21.3 and zod 3.25.76 → 4.4.3 entries in the lockfile are firebase-tools' own transitive dependencies, not the app's — the app does not depend on either.

The existing gaxios -> uuid: 11.1.1 override in the root package.json is still needed and still resolves cleanly after the firebase-tools bump (npm ls uuid exits 0, no ELSPROBLEMS).

functions/ — axios 1.17.0 → 1.19.0 (10 advisories), js-yaml 4.2.0 → 4.3.1 and 3.14.2 → 3.15.1, form-data 4.0.5 → 4.0.6 and 2.5.5 → 2.5.6, body-parser 1.20.5 → 1.20.6, protobufjs 7.6.2 → 7.6.5, brace-expansion across the tree.

Residual advisories (deliberately not fixed)

Both are moderate, both are dev-only (never bundled into the deployed app or into Cloud Functions), and for both the patched line sits beyond the range the parent package declares — so npm audit fix --force "fixes" them by downgrading the parent, which would be a larger regression than the advisory.

Advisory	Path	Why it stays
GHSA-8988-4f7v-96qf — @opentelemetry/core <2.8.0, unbounded memory allocation in W3C Baggage propagation	firebase-tools → @google-cloud/pubsub@5.3.1 → @opentelemetry/core@1.30.1	The newest firebase-tools (15.27.0) still declares @google-cloud/pubsub ^5.2.0, and pubsub 5.x declares @opentelemetry/core ^1.30.1. The patched line is 2.8.0 — reachable only by overriding a transitive dependency past the major its parent declares. npm audit fix --force instead downgrades firebase-tools to 14.23.0. Risk: the advisory needs attacker-controlled W3C Baggage headers to be parsed; the Firebase CLI is a local/CI developer tool that does not process untrusted baggage headers.
GHSA-87mf-gv2c-c62c — ts-deepmerge <8.0.0, prototype method override leads to DoS	firebase-functions-test@3.5.0 → ts-deepmerge@2.0.7	The newest firebase-functions-test (3.5.0) declares ts-deepmerge ^2.0.1; the patched line is 8.0.0 — six majors beyond the declared range, and ts-deepmerge 8 changed its API. npm audit fix --force downgrades firebase-functions-test to 0.3.3. Risk: firebase-functions-test is a test-only helper and is not currently exercised by any test in this repo.

Both should clear on their own once @google-cloud/pubsub 6.x reaches firebase-tools and firebase-functions-test picks up ts-deepmerge 8. Neither trips CI, which gates on npm audit --audit-level=high.

Verification

All run locally on Node 24.19.0, matching the node: ['24.x'] matrix in CI:

Check	Result
npm ci (root) under npm 11.17.0	exit 0
npm ci (functions/) under npm 11.17.0	exit 0
npm audit --audit-level=high (root)	exit 0
npm audit --audit-level=high (functions/)	exit 0
npm run lint (root)	pass
npm run typecheck (root)	pass
npm run build (root)	pass
npm run build (functions/, tsc)	pass
npm ls uuid (root, override integrity)	exit 0, no ELSPROBLEMS

npm ci was deliberately re-run under npm 11.17.0 rather than the locally installed npm 12, because that is the npm that ships with the Node 24.x CI runners — a lockfile regenerated by a newer npm major can otherwise fail npm ci on the older one. Both lockfile versions are unchanged by this PR (root stays lockfileVersion: 3, functions/ stays 2).

Not covered: no browser runtime smoke test of the react-router 7.17 → 7.18 bump. It is a minor version within the declared ^7.17.0, and the type check and production build both pass, but a runtime check would need real Firebase credentials that are not available locally.

Out of scope (noted, not addressed here)

cd functions && npm run lint reports 12 pre-existing @typescript-eslint/no-explicit-any errors in src/utils/symbol/**. They are untouched by this PR — no ESLint or TypeScript version changed in functions/ — and functions lint is not part of CI today. Worth a separate cleanup.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-router-dom@​7.17.0 ⏵ 7.18.2
	postcss@​8.5.15 ⏵ 8.5.26	+1	+18
	firebase-tools@​15.19.1 ⏵ 15.27.0	+7
	axios@​1.17.0 ⏵ 1.19.0		+31

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm re2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/firebase-tools@15.27.0 → npm/re2@1.26.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/re2@1.26.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6914595f-9c54-4fe4-8ecf-77e041c471fd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}