[Snyk] Upgrade firebase-functions from 4.2.1 to 6.6.0 #711

aravindvnair99 · 2025-12-01T09:44:22Z

Snyk has created this PR to upgrade firebase-functions from 4.2.1 to 6.6.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 27 versions ahead of your current version.
The recommended version was released a month ago.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	410	No Known Exploit
Internal Property Tampering SNYK-JS-TAFFYDB-2992450	410	Proof of Concept
Infinite loop SNYK-JS-MARKDOWNIT-6483324	410	Proof of Concept
Symlink Attack SNYK-JS-TMP-11501554	410	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	410	No Known Exploit
Cross-site Scripting SNYK-JS-EXPRESS-7926867	410	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-GRPCGRPCJS-7242922	410	No Known Exploit
Resource Exhaustion SNYK-JS-JOSE-6419224	410	No Known Exploit
Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	410	No Known Exploit
Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	410	No Known Exploit
Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	410	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	410	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-8482416	410	Proof of Concept
Cross-site Scripting SNYK-JS-SEND-7926862	410	No Known Exploit
Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	410	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	410	Proof of Concept

Release notes

Package name: firebase-functions

6.6.0 - 2025-10-20
- Add defineJsonSecret API for storing structured JSON objects in Cloud Secret Manager. (#1745)
- Enhance validation against incomplete/invalid app_remove events to avoid runtime crashes. (#1738)
6.5.0 - 2025-10-08
- Add LLM guidance (#1736)
- Fix issue calling DataSnapshot methods with null data (#1661)
- Adds auth.rawToken to context to allow access to the underlying token. (#1678)
- Fix logger runtime exceptions #(1704)
6.4.0 - 2025-07-15
- Add @ deprecated annotation to callable functions's auth policy (#1675)
- Allows CORS to be a parameter. (#1688)
- Make traceContext accessible (#1696)
6.3.2 - 2025-02-13
6.3.2
6.3.1 - 2025-01-31
- Fix bug where sse response hangs if handler threw an error. (#1668)
6.3.0 - 2025-01-24
- Add onCallGenkit (#1655)
6.2.0 - 2024-12-19
- Add an authPolicy callback to CallableOptions for reusable auth middleware as well as helper auth policies (#1650)
- Handle ESM functions codebases containing top-level awaits, which would break in node 22.12+ (#1651)
- Multiple breaking changes to the not-yet-announced streaming feature for Callable Functions (#1652)
6.1.2 - 2024-12-09
6.1.1 - 2024-11-21
6.1.0 - 2024-10-22
6.0.1 - 2024-09-16
6.0.0 - 2024-09-10
5.1.1 - 2024-08-30
5.1.0 - 2024-08-19
5.0.1 - 2024-05-03
5.0.0 - 2024-05-01
4.9.0 - 2024-04-04
4.8.2 - 2024-03-29
4.8.1 - 2024-03-19
4.8.0 - 2024-03-08
4.7.0 - 2024-02-07
4.6.0 - 2024-01-03
4.5.0 - 2023-11-02
4.4.1 - 2023-06-12
4.4.0 - 2023-05-08
4.3.1 - 2023-04-20
4.3.0 - 2023-04-13
4.2.1 - 2023-02-02

from firebase-functions GitHub release notes

Important

Warning: This PR contains a major version upgrade, and may be a breaking change.
Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade firebase-functions from 4.2.1 to 6.6.0. See this package in npm: firebase-functions See this project in Snyk: https://app.snyk.io/org/aravindvnair99-github-marketplace/project/3e229b24-b2de-4c21-9d58-eebf425f44fc?utm_source=github&utm_medium=referral&page=upgrade-pr

amazon-q-developer · 2025-12-01T09:44:27Z

⏳ Code review in progress. Analyzing for code quality issues and best practices. You can monitor the review status in the checks section at the bottom of this pull request. Detailed findings will be posted upon completion.

Using Amazon Q Developer for GitHub

Amazon Q Developer¹ is an AI-powered assistant that integrates directly into your GitHub workflow, enhancing your development process with intelligent features for code development, review, and transformation.

Slash Commands

Command	Description
`/q <message>`	Chat with the agent to ask questions or request revisions
`/q review`	Requests an Amazon Q powered code review
`/q help`	Displays usage information

Features

Agentic Chat
Enables interactive conversation with Amazon Q to ask questions about the pull request or request specific revisions. Use /q <message> in comment threads or the review body to engage with the agent directly.

Code Review
Analyzes pull requests for code quality, potential issues, and security concerns. Provides feedback and suggested fixes. Automatically triggered on new or reopened PRs (can be disabled for AWS registered installations), or manually with /q review slash command in a comment.

Customization

You can create project-specific rules for Amazon Q Developer to follow:

Create a .amazonq/rules folder in your project root.
Add Markdown files in this folder to define rules (e.g., cdk-rules.md).
Write detailed prompts in these files, such as coding standards or best practices.
Amazon Q Developer will automatically use these rules when generating code or providing assistance.

Example rule:

All Amazon S3 buckets must have encryption enabled, enforce SSL, and block public access.
All Amazon DynamoDB Streams tables must have encryption enabled.
All Amazon SNS topics must have encryption enabled and enforce SSL.
All Amazon SNS queues must enforce SSL.

Feedback

To provide feedback on Amazon Q Developer, create an issue in the Amazon Q Developer public repository.

For more detailed information, visit the Amazon Q for GitHub documentation.

Amazon Q Developer uses generative AI. You may need to verify generated code before using it in your environment. See the AWS Responsible AI Policy. ↩

gemini-code-assist · 2025-12-01T09:44:35Z

Summary of Changes

Hello @aravindvnair99, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request, automatically generated by Snyk, aims to enhance the project's security and functionality by upgrading the firebase-functions dependency from version 4.2.1 to 6.6.0. This significant update addresses a comprehensive list of security vulnerabilities across various components and brings in several new features and stability improvements from the Firebase Functions library. Given the major version jump, it's important to review for potential breaking changes.

Highlights

Dependency Upgrade: The firebase-functions dependency has been upgraded from version 4.2.1 to 6.6.0, a jump of 27 versions.
Security Vulnerability Fixes: This upgrade resolves numerous security vulnerabilities identified by Snyk, including high-severity issues like Asymmetric Resource Consumption and Internal Property Tampering, as well as various medium and low-severity concerns such as Denial of Service and Cross-site Scripting.
New Features and Enhancements: The updated firebase-functions package introduces new capabilities such as the defineJsonSecret API for structured JSON secrets, LLM guidance, and enhanced validation for app_remove events.
Potential Breaking Changes: As this is a major version upgrade, there is a warning that it may contain breaking changes, requiring careful review and testing.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

guardrails · 2025-12-01T09:44:53Z

⚠️ We detected 10 security issues in this pull request:

Insecure File Management (1)

Severity

Details

Docs

High

Title: Path Traversal from user input

Spot-the-Hole/functions/index.js

Line 562 in a532161

path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),

📚

More info on how to fix Insecure File Management in JavaScript.

Insecure Use of Crypto (1)

Severity

Details

Docs

Medium

Title: Insecure use of random generator

Spot-the-Hole/functions/index.js

Line 204 in a532161

result += characters.charAt(Math.floor(Math.random() * charactersLength));

📚

More info on how to fix Insecure Use of Crypto in JavaScript.

Vulnerable Libraries (8)

Severity	Details
High	pkg:npm/busboy@0.3.1 upgrade to: > 0.3.1
N/A	pkg:npm/ejs@3.1.7 upgrade to: 3.1.10
Informational	pkg:npm/cookie-parser@1.4.6 upgrade to: > 1.4.6
High	pkg:npm/firebase-functions@6.6.0 upgrade to: > 6.6.0
High	pkg:npm/eslint@8.54.0 upgrade to: > 8.54.0
Critical	pkg:npm/firebase-admin@11.11.1 (t) upgrade to: > 11.11.1
Critical	pkg:npm/@tensorflow/tfjs-node@3.14.0 upgrade to: > 3.14.0
High	pkg:npm/axios@0.25.0 upgrade to: 1.8.2

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

sonarqubecloud · 2025-12-01T09:45:12Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

amazon-q-developer

Security Upgrade Review Summary

This PR upgrades Firebase Functions from 4.2.1 to 6.6.0, which addresses 16 security vulnerabilities including high-severity issues like asymmetric resource consumption, internal property tampering, and infinite loops. This is a critical security update that should be merged.

Critical Issue Requiring Immediate Attention

Node.js Compatibility: Firebase Functions 6.6.0 requires Node.js 18 or higher, but the project currently specifies Node 14. This will cause deployment failures and must be updated before merging.

Security Benefits

This upgrade resolves multiple high and medium severity vulnerabilities:

High Severity: Asymmetric Resource Consumption, Internal Property Tampering, Infinite Loop vulnerabilities
Medium Severity: Open Redirect, Cross-site Scripting, Resource Exhaustion, Authentication issues
Low Severity: Additional XSS and ReDoS vulnerabilities

Recommendation

Update Node.js version to 18 in package.json engines field
Test thoroughly after the Node.js update as this is a major version upgrade
Merge promptly once Node.js compatibility is resolved to address the security vulnerabilities

The security benefits of this upgrade significantly outweigh the compatibility requirements, making this a high-priority update.

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

amazon-q-developer · 2025-12-01T09:45:40Z

functions/package.json

 		"ejs": "^3.1.7",
 		"firebase-admin": "^11.3.0",
-		"firebase-functions": "^4.2.1",
+		"firebase-functions": "^6.6.0",


🛑 Compatibility Issue: Firebase Functions 6.6.0 requires Node.js 18 or higher, but this project specifies Node 14 in the engines field. This upgrade will cause deployment failures until the Node.js version is updated to 18 or higher.

gemini-code-assist

Code Review

This pull request, automatically generated by Snyk, upgrades firebase-functions from v4.2.1 to v6.6.0. This is a major version upgrade across two major versions (v4 to v6), which introduces potential breaking changes and new requirements.

My review has identified a critical issue: the new version of firebase-functions has a peer dependency on firebase-admin that is not met by your current configuration. This will likely cause your application to fail during installation or at runtime. I have also noted that the required Node.js version for firebase-functions is more specific than what is currently defined in your package.json.

I have provided a detailed comment in functions/package.json with instructions on how to resolve the dependency conflict and a note about the Node.js engine. Please address this to ensure your project remains stable after the upgrade.

gemini-code-assist · 2025-12-01T09:46:34Z

functions/package.json

 		"ejs": "^3.1.7",
 		"firebase-admin": "^11.3.0",
-		"firebase-functions": "^4.2.1",
+		"firebase-functions": "^6.6.0",


This upgrade of firebase-functions to v6.6.0 has some important implications that should be addressed in package.json for correctness and future-proofing.

Incompatible firebase-admin version: firebase-functions@6.6.0 has a peer dependency on firebase-admin with version ^11.10.0 || ^12.0.0 || ^13.0.0. Your package.json specifies ^11.3.0, which is not compatible. While npm may have resolved this to a compatible version in package-lock.json, it is crucial to update package.json to reflect the correct requirement to avoid future installation issues.

Node.js engine requirement: firebase-functions@6.6.0 requires Node.js version >=14.10.0. Your package.json specifies "node": "14". Please ensure your deployment environment uses a compatible Node.js version (14.10.0 or higher), and consider making the engine requirement more specific, e.g., "node": ">=14.10.0".

firebase-admin v12 incompatibility: Note that firebase-admin v12 and later drop support for Node.js 14. Therefore, you should upgrade firebase-admin to the latest compatible v11 release, which is 11.11.1.

To fix the dependency issue, please update firebase-admin in your package.json:

"dependencies": { ... "firebase-admin": "^11.11.1", "firebase-functions": "^6.6.0", ... }

stale · 2025-12-16T02:44:26Z

Automatically marked as stale due to lack of recent activity. Will be closed if no further activity occurs. Thank you for your contributions.

pull-request-size bot added the size/XS label Dec 1, 2025

amazon-q-developer bot reviewed Dec 1, 2025

View reviewed changes

gemini-code-assist bot reviewed Dec 1, 2025

View reviewed changes

stale bot added the stale label Dec 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[Snyk] Upgrade firebase-functions from 4.2.1 to 6.6.0 #711

[Snyk] Upgrade firebase-functions from 4.2.1 to 6.6.0 #711

Uh oh!

aravindvnair99 commented Dec 1, 2025

Uh oh!

amazon-q-developer bot commented Dec 1, 2025

Slash Commands

Features

Customization

Feedback

Uh oh!

gemini-code-assist bot commented Dec 1, 2025

Uh oh!

guardrails bot commented Dec 1, 2025

Uh oh!

sonarqubecloud bot commented Dec 1, 2025

Uh oh!

amazon-q-developer bot left a comment

Uh oh!

amazon-q-developer bot Dec 1, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Dec 1, 2025

Uh oh!

stale bot commented Dec 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

[Snyk] Upgrade firebase-functions from 4.2.1 to 6.6.0 #711

Are you sure you want to change the base?

[Snyk] Upgrade firebase-functions from 4.2.1 to 6.6.0 #711

Uh oh!

Conversation

aravindvnair99 commented Dec 1, 2025

Snyk has created this PR to upgrade firebase-functions from 4.2.1 to 6.6.0.

Issues fixed by the recommended upgrade:

Uh oh!

amazon-q-developer bot commented Dec 1, 2025

Slash Commands

Features

Customization

Feedback

Footnotes

Uh oh!

gemini-code-assist bot commented Dec 1, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

guardrails bot commented Dec 1, 2025

Uh oh!

sonarqubecloud bot commented Dec 1, 2025

Quality Gate passed

Uh oh!

amazon-q-developer bot left a comment

Choose a reason for hiding this comment

Security Upgrade Review Summary

Critical Issue Requiring Immediate Attention

Security Benefits

Recommendation

Uh oh!

amazon-q-developer bot Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

stale bot commented Dec 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants