fix: audit dependencies and replace deprecated url.parse usage - #10923
fix: audit dependencies and replace deprecated url.parse usage#10923inlined wants to merge 1 commit into
Conversation
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request replaces the deprecated url.parse() with the URL API, refactors the deployment executor to use retry predicates instead of numeric codes, and implements automatic cleanup of newly created service accounts on 100% deployment failure. Feedback on the changes highlights a potential secondary crash in the isServiceAccount404 error handler, multiple violations of the repository style guide regarding the use of any as an escape hatch in Cloud SQL connector files, and an incomplete synchronous implementation of addUserProjectAndAuthHeaders in FBToolsAuthClient.
18df973 to
830b074
Compare
inlined
changed the title
6fbc53d to
181a442
Compare
f8252ce to
499887c
Compare
joehan
left a comment
joehan
left a comment
There was a problem hiding this comment.
Looks like you need to lint + fix some shrinkwrap issues, but if we get the tests passing I think this is a good change
499887c to
f78ec23
Compare
5801c47 to
1988f44
Compare
3 participants
Security Audit & Remediation: firebase-tools
A. Previous CVEs
ws(Severity: High)websocket-driver(Severity: Critical)websocket-driver(Severity: Critical)url.parse()deprecation in authentication flowB. Changes Made
npm update.overridesinpackage.jsonforws,uuid,postcss,tar-fs,undici,re2,gaxios, andgoogle-auth-library.url.parse()usage with modernnew URL()API insrc/auth.tsto resolve Node.jsDEP0169deprecation warnings.winstonlog formatter insrc/logger.tsfor compatibility with upgradedwinston/triple-beamtypes.C. Remaining CVEs
protobufjs-cliviafirebase-admin@11->google-gax: Transitive dependency; no non-breaking fix available upstream (requires major upgrade tofirebase-admin@14).vite/esbuild: DevDependency; requires major version upgrade tovite@8.next: DevDependency; requires major version upgrade tonext@16.D. Introduced CVEs
E. Testing Strategy
npm test,npm run mocha:fast,npx mocha src/utils.spec.ts) - passing.npm run test:compile) - 0 errors.npm run lint:changed-files,npm run format).Release Notes
relnote: Audit dependencies, remediate CVEs, and replace deprecated url.parse usage with standard URL API.