[dependabot]

Bumps stream-json to 3.8.0 and updates ancestor dependency firebase-tools. These dependencies need to be updated together.

Updates stream-json from 1.9.1 to 3.8.0

Commits

• 0f70a66 New version: 3.8.0.
• 33dc490 Generated split tests from JSON's grammar.
• c04c86d Widened the lookbehind check to all of src.
• 9c3e828 Dropped the stringers' lookbehind for the u flag.
• b682201 Made an array replacer follow JSON.stringify.
• 588031f Capped the release wait in the file cleanup test.
• 57f73f1 Escaped lone surrogates in the stringers.
• 466acb4 Kept surrogate pairs whole; widened property tests.
• d991802 Updated stream-chain to 4.4.1.
• 0c4f3af Documented checking a whole document with once.
• Additional commits viewable in compare view

Updates firebase-tools from 15.25.0 to 15.34.2

Release notes

Sourced from firebase-tools's releases.

v15.34.2

• Updated chokidar dependency to ^4.0.3 to remove vulnerable braces dependency (#11308).
• Fixed an issue where the Firebase MCP server referred to update_firebase_environment instead of firebase_update_environment.
• Updated the Firebase SQL Connect local toolkit to v3.4.25, which includes the following changes:
  • Internal improvements and bug fixes.
• Fixed CVE-2026-111181 by updating body-parser dependency.
• Fixed the Firestore emulator exiting when it could not watch the rules file for changes. It now logs a warning instead. (#4298)

v15.34.1

• Ensured the Firebase Hosting API is enabled before deploying and running other Hosting commands.
• Fixed an issue where empty inputs were accepted for Secret param values in Firebase Functions.
• Fixed an issue where the Firebase MCP server always suggested npx firebase-tools@latest even when the firebase CLI was installed.
• Fixed a Node.js url.parse() deprecation warning during firebase login.
• Updated the Firebase SQL Connect local toolkit to v3.4.24, which includes some internal bug fixes.
• Fixed 2nd Gen Auth Emulator CloudEvent payloads to conform to the Eventarc google.events.firebase.auth.v2.AuthEventData wire format (metadata.createTime, providerData[].uid, and removing tenantId from nested user data).

v15.34.0

• Fixed an issue where hosting:clone failed to locate source sites in other projects. (#11247)
• Updated Pub/Sub emulator to version 0.8.37.
• Fixed an issue where analytics timeouts could mask command errors or cause successful commands to exit with an error. (#6989)
• Fixed an issue where unhandled exceptions during Cloud Functions deployment could be silently ignored and exit with code 0 (#6989).
• Added crashlytics:heapdumps:{enable,disable,status} commands to manage Crashlytics Android heap dump collection. (#11225)
• Removed unused dependencies proxy-agent, universal-analytics, and @apphosting/common.
• Fixed an issue where throttled task queues stopped processing remaining tasks when a task exhausted its retries or timed out (#6989, #11040).
• Fixed a race condition in SourceTokenScraper that could cause concurrent function deployments to hang when refreshing an expired source token (#6989).
• Fixed an issue where a Function Kit and a functions codebase sharing the same source directory failed firebase.json validation. (#11253)
• Fixed an issue where Cloud Functions creation did not retry on HTTP 403 service account propagation errors. (#11251)
• Updated Auth deployment to use existing apps from any platform before creating a default web app. (#11250)
• No longer grant unecessary TRUNCATE privilege to writer roles in dataconnect:sql:migrate. (#11276)
• Updated the Firebase SQL Connect local toolkit to v3.4.23, which includes the following changes:
  • Updated the Golang dependency version to 1.26.9.
  • Improved Native SQL query validation, wrapper aliasing, and line-comment handling to support the SQL editor in Firebase SQL.

v15.33.0

• Updated Firebase Hosting API requests to be project-scoped, eliminating site-scoped requests and the use of - as a project identifier.
• Added check for a default Hosting site and offer to create one during firebase apps:create web.
• Added a check for a default Hosting site and offer to create one during auth initialization.
• Started reporting the GCFv2-to-GCFv1 downgrade error during validation instead of a misleading CPU error (#5461).
• Fixed functions:delete recreating an already-deleted Cloud Tasks queue for task queue functions. (#9305)
• Batched function deletions across instances when uninstalling a Function Kit (#11189).
• Fixed an issue where 2nd-gen functions with parameterized trigger event filters failed default region resolution (#11020).
• Fixed functions:lifecycle:list and functions:lifecycle:run failing to detect Function Kit instances (#11240).
• Fixed nested ternary CEL expressions in function parameters, which previously failed to load or selected the wrong branch. (#7755)

v15.32.1

• Improved error message when billing is not enabled
• Fixed a crash in setEnqueuer when deploying Cloud Tasks functions whose IAM policy has no bindings (#11184).
• Updated dependencies to address security vulnerabilities, including protobufjs, tar, @grpc/grpc-js, express, undici, hono, tmp, and form-data.
• Updated the Firebase SQL Connect local toolkit to v3.4.22, which includes the following changes:
  • [fixed] Disallow using the GraphQL root operation type names (Query, Mutation, Subscription) as @table or @view types.

... (truncated)

Commits

• c3cdfc5 15.34.2
• 87a0829 Update FDC emulator to v3.4.25 (#11380)
• 8d61a49 fix(storage): await rules watcher readiness on startup and deflake reload int...
• cd54930 fix(deps): resolve body-parser CVE-2026-111181 vulnerability (#11373)
• 83ffba0 fix(emulator): warn instead of crashing when the Firestore rules watcher fail...
• a33ca10 fix(crashlytics): remove crashlyticsWeb experiment (#11372)
• 050d819 removing logging bucket and sink provisioning as it is covered by the telemet...
• 855f140 feat(crashlytics): allowlist clienttelemetry.googleapis.com in API key restri...
• 926b3fe [AI Improvement] [Task] Autofix no-unnecessary-type-assertion and no-extra-no...
• 311412f fix/refactor: [Task] Remove dead schemaToText/connectorToText/sourceToText fr...
• Additional commits viewable in compare view