Bump tar and firebase-tools in /functions

[dependabot]

Bumps tar to 7.5.21 and updates ancestor dependency firebase-tools. These dependencies need to be updated together.

Updates tar from 6.1.11 to 7.5.21

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

• cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0

v6.1.12

6.1.12 (2022-10-31)

Bug Fixes

• 57493ee #332 ensuring close event is emited after stream has ended (@​webark)
• b003c64 #314 replace deprecated String.prototype.substr() (#314) (@​CommanderRoot, @​lukekarrys)

Documentation

• f129929 #313 remove dead link to benchmarks (#313) (@​yetzt)
• c1faa9f add examples/explanation of using tar.t (@​isaacs)

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates firebase-tools from 9.10.0 to 15.24.0

Release notes

Sourced from firebase-tools's releases.

v15.24.0

• Add declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions
• Fixed an issue in apps:create where App Store ID was always prompted for even when unnecessary.
• Add functions:lifecycle:list and functions:lifecycle:run commands to view and run lifecycle hooks in isolation.
• Updated the Firebase SQL Connect local toolkit to v3.4.15, which supports for 1:1 nested mutations. (#10773)
• Support for specifying that the input for a string or string[] param in Functions must be non-empty (#10678)
• Removed the warning that Dart functions may not yet be visible in the Firebase Console, since they are now shown.
• Fixed dataconnect:execute command help text. The right env var should be FIREBASE_DATA_CONNECT_EMULATOR_HOST, with an underscore between DATA and CONNECT.
• Updated the Firebase SQL Connect local toolkit to v3.4.16, which includes the following changes:
  • Updated the Golang dependency version to 1.25.12.
• Fixed a Hosting emulator timeout when a web frameworks request with a body falls through to a function rewrite. (#10760)

v15.23.0

• Add declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions
• Fixed an issue in apps:create where App Store ID was always prompted for even when unnecessary.
• Add functions:lifecycle:list and functions:lifecycle:run commands to view and run lifecycle hooks in isolation.
• Updated the Firebase SQL Connect local toolkit to v3.4.15, which supports for 1:1 nested mutations. (#10773)

v15.22.4

• Fixes auth:export and auth:import dropping mfaInfo data for users with Multi-Factor Authentication enabled.
• Updated Pub/Sub emulator to version 0.8.34

v15.22.3

• Disable 'keep-alive' in google-auth-library calls to avoid Premature close errors on some Node versions (#10716).

v15.22.2

• Upgrade zod to v4 and drop the deprecated zod-to-json-schema dependency in favor of zod v4's built-in z.toJSONSchema().
• Updated the Firebase Data Connect local toolkit to v3.4.14, which includes the following changes:
  • Fix linter warnings in generated Kotlin SDK files.
• Changed calls to 'cloudbilling.googleapis.com' to use user project quota to avoid shared quota exhaustion issues. If you are using CI token based auth in CI/CD, please ensure that you enable cloudbilling.googleapis.com before you update to this version.
• Fixed an intermittent "Premature close" error during login and API requests by retrying once without keep-alive. (#10692)

v15.22.1

• Fixed various issues with Data Connect emulator / deploy by updating binary to version 3.4.13.
• Temporarily pinned firebase-docker-image to Node 24.16.0 to mitigate nodejs/node#63989.

v15.22.0

• Added apphosting:secrets:revokeaccess command. (#10669)
• Updated Pub/Sub emulator to version 0.8.33.
• Updated Data Connect emulator to version 3.4.12.
• Fix Data Connect non-deterministic output order of generated SDK files when compiled from multiple GQL source files.
• Optimize Data Connect singular relation filters on PKs to avoid EXISTS subqueries.

v15.21.0

• Fixed an issue where login:*, target:*, and ext:* subcommands were missing from firebase --help.
• Functions can declare additional API dependencies (#10621)
• Added mock Passkey (WebAuthn) support to the Auth emulator. (#10636)
• Fixes spawn activate.bat ENOENT error on Windows when initializing Python functions. (#10608)

... (truncated)

Commits

• 6e56bbf 15.24.0
• 58e5520 feat: implement progressive CLI help disclosure and dynamic deploy help (#10772)
• f86d2fa preserve request body when a web frameworks rewrite falls through to a Cloud ...
• c925ef7 chore: upgrade firebase-admin and firebase-functions in E2E tests (#10793)
• 6f7e5ef Update FDC emulator to v3.4.16 (#10798)
• 8ed5f8f Fix env var name in dataconnect:execute help text. (#10771)
• c5fc05b Release v2.4.2 (#10745)
• c5ba39a Rename DeploymentEvent to LifecycleEvent to ensure we have consistent naming ...
• 83570ee fix(security): default service account sentinel and partial deploy validation...
• bdf7c51 feat: prompt user before executing lifecycle hooks when recovering from parti...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.