[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #621

The transitive dependency @grpc/grpc-js 1.14.4 is affected by two Dependabot security alerts, both with the vulnerable range >= 1.14.0, < 1.14.5:

• 242 GHSA-m9gg-hp2v-232j / CVE-2026-101916 (high): In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
• 243 GHSA-f596-whhp-79r4 / CVE-2026-101915 (low): The server transmits some error messages thrown by method handlers to the client in status messages

Both are fixed in 1.14.5. @grpc/grpc-js is required as ^1.10.9 by google-gax 4.4.1, which is reached via firebase-admin 13.9.0 → @google-cloud/firestore 7.11.0 (an optional dependency of firebase-admin). It is not a development dependency, so it is part of the production dependency tree.

Approach

Lock-file-only update via npm update @grpc/grpc-js. This resolves 1.14.6, the latest 1.x release within the ^1.10.9 range of google-gax, instead of the 1.14.5 proposed in #621. 1.14.6 also addresses remaining instances of GHSA-f596-whhp-79r4.

The lock file changes are limited to @grpc/grpc-js 1.14.4 → 1.14.6. Its dependency ranges (@grpc/proto-loader ^0.8.0, @js-sdsl/ordered-map ^4.4.2) are unchanged and remain satisfied by the installed versions.

Changes

• 1.14.5: Servers no longer send error messages thrown by method handlers to the client in status messages by default (GHSA-f596-whhp-79r4)
• 1.14.5: getAuthContext no longer returns unverified client certificates as though they were verified when server credentials set requireClientCertificate to false (GHSA-m9gg-hp2v-232j)
• 1.14.5: Fixed stale call data accumulating if a channel failed to connect for a long period of time (grpc-js: Remove calls from the pick queue immediately when they end grpc/grpc-node#3078)
• 1.14.5: Fixed call status being reported with expected fields missing (grpc-js: Ensure message send errors have proper status information grpc/grpc-node#3079)
• 1.14.5: Avoid redundant end() calls on completed HTTP/2 streams, unify call numbers and avoid disabled trace allocations (fix(grpc-js): avoid redundant end() calls on completed HTTP/2 streams grpc/grpc-node#3082, chore(grpc-js): unify call numbers and avoid disabled trace allocations grpc/grpc-node#3084)
• 1.14.6: Server interceptors no longer transmit error details by default, addressing remaining instances of GHSA-f596-whhp-79r4 (grpc-js: Don't transmit error details by default in server interceptors (1.14.x) grpc/grpc-node#3105). The new GRPC_NODE_DEBUG_SEND_ERROR_DETAILS environment variable re-enables sending them for debugging.
• 1.14.6: Fewer allocations on the request, metadata, channelz, retry and call credentials paths (perf(grpc-js): avoid Date allocations on request and channelz tracking paths grpc/grpc-node#3090, perf(grpc-js): avoid throwaway timer allocation in ResolvingCall grpc/grpc-node#3092, perf(grpc-js): avoid building metadata map when parsing trailers grpc/grpc-node#3093, perf(grpc-js): lazily allocate Metadata opaqueData map grpc/grpc-node#3095, perf(grpc-js): cache precomputed serviceUrl in InternalChannel grpc/grpc-node#3097, perf(grpc-js): memoize method config lookup in default config selector grpc/grpc-node#3098, perf(grpc-js): avoid array allocation for single-value metadata headers grpc/grpc-node#3099, perf(grpc-js): avoid allocations for empty CallCredentials on the RPC hot path grpc/grpc-node#3100, perf(grpc-js): avoid redundant metadata clone in RetryingCall on initial attempt grpc/grpc-node#3101)

See the 1.14.5 and 1.14.6 release notes.

Breaking Changes

None. Both are patch releases, and 1.14.6 declares the same engines.node (>=12.10.0) and dependency ranges as 1.14.4. The changed defaults only affect applications that run @grpc/grpc-js servers; google-gax uses it as a client.

Code Changes Required

None — the upgrade is a drop-in replacement. This adapter imports only firebase-admin/app and firebase-admin/messaging. FCM messaging uses http, https and http2, and firebase-admin loads @google-cloud/firestore (and with it @grpc/grpc-js) only when the Firestore API is accessed, which this adapter does not do.

Tasks

No tasks apply; this PR only updates the lock file.

Summary by CodeRabbit

• Chores
  • Updated an underlying networking component to a newer patch release. This is a maintenance update; no user-facing feature changes or behavior changes are noted. Its impact is limited to the component update, and no changes to app functionality are described in this release.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: c1c92d16-e615-4865-9b06-d47f1ed14727

📥 Commits

Reviewing files that changed from the base of the PR and between 2ff1bb6 and 7e35ab4.

📒 Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

The lockfile updates @grpc/grpc-js from version 1.14.4 to 1.14.6. It also updates the package resolution and integrity values, and adds an Apache-2.0 license field to the package record.

Changes: gRPC package update

Layer / File(s)	Summary
Update the locked gRPC version package-lock.json	The package and dependency records now reference @grpc/grpc-js 1.14.6 with updated resolution and integrity values. The package record adds an Apache-2.0 license field.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: semantic-release-bot

Merge Risk: ⚪ Minimal · up to 7e35a

The updated dependency clears both stated advisories, and no actionable merge-blocking risk remains.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title uses the allowed "fix:" prefix, starts the summary with a capitalized "Bump," and accurately describes the dependency update.
Description check		The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the security issue, dependency path, selected version, scope, and absence of required tasks.
Linked Issues check		Issue #621 requires an update from @grpc/grpc-js 1.14.4 that includes the 1.14.5 security and bug fixes. The lock file updates both dependency records to 1.14.6, which is a later patch release and, as…
Out of Scope Changes check		The whole-PR diff contains only package-lock.json changes for @grpc/grpc-js, plus the corresponding resolved metadata, integrity value, and generated license field. These changes directly support the …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		PASS: The pull request changes only package-lock.json. It replaces @grpc/grpc-js 1.14.4 with 1.14.6, including the matching tarball and integrity hash. The vulnerable 1.14.4 range is no longer present…
Engage In Review Feedback		No review feedback comments or actionable findings were supplied. The engagement requirement is therefore inapplicable to this pull request.

Full details: Linked Issues check

Explanation

Issue #621 requires an update from @grpc/grpc-js 1.14.4 that includes the 1.14.5 security and bug fixes. The lock file updates both dependency records to 1.14.6, which is a later patch release and, as documented in the PR, includes the 1.14.5 fixes and the remaining GHSA-f596-whhp-79r4 fix. The diff also updates the resolved archive and integrity value.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff contains only package-lock.json changes for @grpc/grpc-js, plus the corresponding resolved metadata, integrity value, and generated license field. These changes directly support the dependency update for issue #621. No unrelated source, test, or configuration changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS: The pull request changes only package-lock.json. It replaces @grpc/grpc-js 1.14.4 with 1.14.6, including the matching tarball and integrity hash. The vulnerable 1.14.4 range is no longer present, and no application code or new security-sensitive pattern is introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.18%. Comparing base (2ff1bb6) to head (7e35ab4).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #622   +/-   ##
=======================================
  Coverage   99.18%   99.18%           
=======================================
  Files          11       11           
  Lines        1841     1841           
=======================================
  Hits         1826     1826           
  Misses         15       15           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 8.5.6