chore(deps): bump firebase-admin from 11.3.0 to 12.1.1 in /functions

[dependabot]

Bumps firebase-admin from 11.3.0 to 12.1.1.

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Node.js SDK v12.1.1

Bug Fixes

• fix: Export error classes (#2151)

Miscellaneous

• [chore] Release 12.1.1 (#2561)
• build(deps): updgrade jwks-rsa (#2570)
• --- (#2568)
• --- (#2566)
• --- (#2567)
• --- (#2569)
• build(deps-dev): bump @​firebase/auth-types from 0.12.1 to 0.12.2 (#2556)
• build(deps-dev): bump @​microsoft/api-extractor from 7.43.2 to 7.43.7 (#2559)
• chore: upgrade firestore to 7.7.0 (#2560)
• build(deps-dev): bump @​firebase/app-compat from 0.2.32 to 0.2.33 (#2555)
• build(deps): bump @​google-cloud/firestore from 7.6.0 to 7.7.0 (#2558)
• Fix api extractor issues to expose error types (#2549)
• build(deps-dev): bump @​types/lodash from 4.17.0 to 4.17.1 (#2546)
• build(deps): bump @​google-cloud/storage from 7.10.2 to 7.11.0 (#2547)
• build(deps-dev): bump @​microsoft/api-extractor from 7.43.1 to 7.43.2 (#2545)
• build(deps): bump @​types/node from 20.12.7 to 20.12.10 (#2544)
• build(deps-dev): bump @​firebase/app-compat from 0.2.31 to 0.2.32 (#2540)
• build(deps): bump @​google-cloud/storage from 7.10.1 to 7.10.2 (#2541)
• build(deps): bump @​google-cloud/storage from 7.10.0 to 7.10.1 (#2536)
• Update package.json to use farmhash 3.3.1 (#2534)

Firebase Admin Node.js SDK v12.1.0

New Features

• feat(rc): Add server side Remote Config support (#2529)

Miscellaneous

• [chore] Release 12.1.0 (#2532)
• Fix minor typo (#2533)
• chore: Excluding certain event_types from processing uid (#2370)
• build(deps-dev): bump gulp from 4.0.2 to 5.0.0 (#2526)
• build(deps-dev): bump @​firebase/app-compat from 0.2.29 to 0.2.30 (#2527)
• build(deps): bump @​google-cloud/firestore from 7.5.0 to 7.6.0 (#2528)
• build(deps): bump undici in /.github/actions/send-email (#2521)
• build(deps-dev): bump @​firebase/auth-types from 0.12.0 to 0.12.1 (#2514)
• build(deps-dev): bump mocha from 10.3.0 to 10.4.0 (#2513)
• build(deps): bump @​types/node from 20.11.30 to 20.12.2 (#2516)
• build(deps): bump @​google-cloud/firestore from 7.4.0 to 7.5.0 (#2517)
• build(deps-dev): bump @​firebase/app-compat from 0.2.28 to 0.2.29 (#2510)
• build(deps): bump @​google-cloud/storage from 7.7.0 to 7.9.0 (#2509)

... (truncated)

Commits

• e2515f2 [chore] Release 12.1.1 (#2561)
• 4d4fd39 build(deps): updgrade jwks-rsa (#2570)
• 1754b7e --- (#2568)
• 72f0169 --- (#2566)
• 8f622cf --- (#2567)
• f8f8eb9 --- (#2569)
• ee78c87 build(deps-dev): bump @​firebase/auth-types from 0.12.1 to 0.12.2 (#2556)
• f837c23 build(deps-dev): bump @​microsoft/api-extractor from 7.43.2 to 7.43.7 (#2559)
• 41aea3a chore: upgrade firestore to 7.7.0 (#2560)
• 26cd8b0 build(deps-dev): bump @​firebase/app-compat from 0.2.32 to 0.2.33 (#2555)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[guardrails]

⚠️ We detected 8 security issues in this pull request:

Insecure File Management (1)

Severity	Details	Docs
High	Title: Path Traversal from user input Spot-the-Hole/functions/index.js Line 562 in 60da36e path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),	📚

More info on how to fix Insecure File Management in JavaScript.

---

Insecure Use of Crypto (1)

Severity	Details	Docs
Medium	Title: Insecure use of random generator Spot-the-Hole/functions/index.js Line 204 in 60da36e result += characters.charAt(Math.floor(Math.random() * charactersLength));	📚

More info on how to fix Insecure Use of Crypto in JavaScript.

---

Vulnerable Libraries (6)

Severity	Details
N/A	pkg:npm/ejs@3.1.7 upgrade to: 3.1.10
Critical	pkg:npm/@tensorflow/tfjs-node@3.14.0 upgrade to: > 3.14.0
Critical	pkg:npm/firebase-admin@12.1.1 upgrade to: > 12.1.1
High	pkg:npm/busboy@0.3.1 upgrade to: > 0.3.1
Medium	pkg:npm/axios@0.25.0 upgrade to: 1.6.0
High	pkg:npm/firebase-functions@4.2.1 upgrade to: > 4.2.1

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[stale]

Automatically marked as stale due to lack of recent activity. Will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Automatically closed due to lack of recent activity. Tag @aravindvnair99 to reopen. Thank you for your contributions.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.