chore(deps): bump tar and firebase-tools in /hosting

[dependabot]

Bumps tar to 7.5.16 and updates ancestor dependency firebase-tools. These dependencies need to be updated together.

Updates tar from 6.2.1 to 7.5.16

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• 302f51f fix inconsequential typo in PENDINGLINKS symbol name
• 55dbb99 remove some uses of mutate-fs
• 87cc309 7.5.15
• 7aef486 fix: regression in pending links detection
• 6244eb3 7.5.14
• 9704d8c stricter protection against hardlinks preempting their targets
• 700734f update workflows and deps
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates firebase-tools from 14.4.0 to 15.20.0

Release notes

Sourced from firebase-tools's releases.

v15.20.0

• Removed the prompt and backend deletion of Data Connect services during firebase deploy. (#10619)
• Fixes firebase init dataconnect failing with ENOEXEC when creating a new template app on some operating systems. (#10616)
• Support setting the Google Cloud Storage (GCS) test results bucket in apptesting:execute and appdistribution:distribute

v15.19.1

• Updated Firebase SQL Connect genAI features to use new Agent Service API
• Updated the Firebase Data Connect local toolkit to v3.4.10, which includes the following changes:
  • Extended client cache consistency validation to include conflicts with schema field names.

v15.19.0

• Updated Pub/Sub emulator to version 0.8.32
• Added support for 6 more iD providers in auth:import and auth:export commands
• Fixed issue where auth:export didn't escape double quotes for CSV format. (#3484)
• Fixes CloudSQLConnectorError: The connector was closed unhandled exception during Data Connect deployments. (#10555)
• Updated the Firebase Data Connect local toolkit to v3.4.9, which includes the following changes: (#10567)
  • Added support for nested mutations for literals and also variables that define an incomplete set of fields.
  • Fixed an issue in the JS Generated SDK where QueryFetchPolicy wasn't being respected.

v15.18.0

• Updated Pub/Sub emulator to version 0.8.31
• Resolves undefined regions earlier, during the build to backend resolution phase (#10471)
• Updated the Firebase Data Connect local toolkit to v3.4.8, which includes the following changes:
  • Fixed an issue in Dart code generation where nullable BigInt was not handled correctly.
  • Added support for nested 1:Many relational batch inserts.
  • Updated the Golang dependency version to 1.25.10.
• Default timeout for Dart functions is now 60 seconds when not explicitly set (#10501)
• Support secret environment variables for Cloud Run functions (#10489)
• Set requiredProjectBindings in AI Logic services (#10503)

v15.17.0

• Added support for creating search indexes for Firestore. (#10431)
• Fixed an issue where some MCP tools would error with "Invalid input: expected record, received array". (#10437)
• Fixed an issue causing errors when multiple Firestore databases were configured in firebase.json (#8114)
• Updated the Firebase Data Connect local toolkit to v3.4.7, which includes the following changes: (#10461)
  • Fix emulator crash when using uuidv4() on operations.
  • Support for _Data input types as variables with @allow(fields, maxCount) to constraint the input JSON, enabling batch mutations in admin SDK. Client SDK support will come soon.
• Increase supported range for Next.js to version 16.0 (#9463)
• Updated Cloud Function default resource locations. This does not affect existing functions. (#10414)
• Added warning for cross-region event triggers (#10408)

v15.16.0

• Updated Firestore Emulator to v1.21.0, which adds support for subqueries and new stages like let(...), as well as allowing setting database-edition per-database.
• Suppressed the 'punycode' deprecation warning during firebase deploy on Node 22. (#10385)
• Fixed an issue where hosting deploy allowed publishing to a site in a different project. (#10376)
• Added SSE mode support to firebase mcp. To use it, run firebase mcp --mode=sse --port=3000, and connect your client on http://localhost:3000.
• Update the valid Python runtimes for functions. Default Python runtime is now Python 3.14.
• Fix CLI non-interactive mode for dataconnect init (#10401)
• Fixed issue where rules for non-default Firestore databases were not being deployed correctly.
• Suppress SSR warning for non-SSR Angular projects on init hosting (#10364)

... (truncated)

Commits

• 978a2ef 15.20.0
• 74f62c6 Add changelog entry for PR #10619 (#10622)
• 5aff739 fix: update dependencies in integration script packages to remediate vulnerab...
• 6b9723e Remove Data Connect service deletion logic on deploy (#10619)
• 07931cf fix: update dependencies in standalone bundler to remediate vulnerabilities (...
• 073a953 fix: use cross-spawn to avoid exec format errors when creating dataconnect ap...
• 7657d15 Update version of telemetry admin api (#10617)
• 1657829 fix: update dependencies in firebase-vscode to remediate vulnerabilities (#10...
• 7f54806 fix mistake in class initialization for ailogic (#10570)
• b665c53 Add --results-bucket update to CHANGELOG.md (#10604)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	firebase-tools@​14.4.0 ⏵ 15.20.0	-14			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm firebase-tools is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: hosting/package-lock.json → npm/firebase-tools@15.20.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/firebase-tools@15.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report