chore(deps): bump js-yaml and firebase-tools

[dependabot]

Bumps js-yaml to 4.3.1 and updates ancestor dependency firebase-tools. These dependencies need to be updated together.

Updates js-yaml from 3.14.2 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• Additional commits viewable in compare view

Updates firebase-tools from 15.18.0 to 15.26.0

Release notes

Sourced from firebase-tools's releases.

v15.26.0

• Automatically enable non-interactive mode when an AI agent is detected in the environment to prevent the CLI from hanging on interactive prompts.
• Added support for a two-phase non-interactive login flow. Initiate this by running firebase login --non-interactive, navigate to the printed link to get an authorization code, and complete the login by running firebase login <auth_code>.
• Fixed apps:init writing google-services.json to an app/app path when the Android module has no src directory, by detecting the module from the directory basename instead of the first path segment (#10863).
• Fixed firestore:locations failing with a null project error when run without an active project (#10881).
• Fixed authentication refresh issue under Application Default Credentials (ADC) when no project is active (#10880).
• Added crashlytics:onboard:web CLI command to support Crashlytics onboarding for web apps.
• Added hidden source map support to crashlytics:sourcemap:upload.
• Fixed typo in loginPrototyper URL which caused issues during Firebase MCP server firebase_login
• Added appcheck:services:list, appcheck:services:get and appcheck:services:set to read and change App Check enforcement per service.
• Fixed unenforced read-only isolation for Native SQL queries for Firebase SQL Connect.

Firebase CLI v15.26.0-sea.preview.2 (Pre-Signed SEA Preview)

Experimental standalone binaries with automated Mach-O ad-hoc code signing and true Universal 2 binaries.

Firebase CLI v15.26.0-sea.preview.1 (Node 26 SEA Preview)

Experimental standalone binaries for firebase-tools built using Node 26 Single Executable Applications (SEAs).

v15.25.1

• Fix typo that was breaking the emulator handling of secret params (issue #10866)
• Fixes service account propagation delays during Cloud Functions deploys and cleans up newly created service accounts on 100% deployment failure (#10871).
• Fixed appcheck:debugtokens:list and appcheck:debugtokens:delete prompting "Select the app to register a debug token for" when asking which app to operate on.

v15.25.0

• Update Firestore emulator to v1.22.0, adding support for DML
• Add appcheck:debugtokens:create, appcheck:debugtokens:list, and appcheck:debugtokens:delete CLI commands for managing App Check debug tokens (#10801).
• Add MCP-Protocol-Version, Mcp-Method, and Mcp-Name HTTP headers to OneMcpServer requests per the MCP 0728 standard release candidate (https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ and https://modelcontextprotocol.io/seps/2243-http-standardization).
• Fixes Storage Emulator to support JSON uploads larger than 100KB without hanging or throwing 413 error (#8355)
• Add extdeprecationwarnings experiment to display phased deprecation notices and guidance across ext:* CLI commands.
• Fixes Data Connect emulator crash when in-flight GraphQL requests are cancelled (#10821)
• Fixed a Cloud Storage emulator hang under concurrent requests, caused by the rules runtime's stdout being parsed per-chunk instead of per-line so batched responses were dropped (#6194, #6865).
• Support for specifying that the input for a string or string[] param in Functions must be non-empty (#10678)
• Removed the warning that Dart functions may not yet be visible in the Firebase Console, since they are now shown.
• Add the V1 environment variable FUNCTION_REGION to v2 functions (#10862)

v15.24.0

• Add declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions
• Fixed an issue in apps:create where App Store ID was always prompted for even when unnecessary.
• Add functions:lifecycle:list and functions:lifecycle:run commands to view and run lifecycle hooks in isolation.
• Updated the Firebase SQL Connect local toolkit to v3.4.15, which supports for 1:1 nested mutations. (#10773)
• Support for specifying that the input for a string or string[] param in Functions must be non-empty (#10678)
• Removed the warning that Dart functions may not yet be visible in the Firebase Console, since they are now shown.
• Fixed dataconnect:execute command help text. The right env var should be FIREBASE_DATA_CONNECT_EMULATOR_HOST, with an underscore between DATA and CONNECT.
• Updated the Firebase SQL Connect local toolkit to v3.4.16, which includes the following changes:
  • Updated the Golang dependency version to 1.25.12.
• Fixed a Hosting emulator timeout when a web frameworks request with a body falls through to a function rewrite. (#10760)

v15.23.0

• Add declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions

... (truncated)

Commits

• 7ee389e 15.26.0
• 5ab9db5 feat: automatically enable non-interactive mode for AI agents (#10856)
• 4da67f4 fix(vscode): resolve false "Firebase CLI not installed" warnings (#10874)
• 7620545 Update fdc emulator to 3.4.17 (#10894)
• 568fc63 fix: validate active project in firestore:locations command (#10881)
• 4f2a6bf fix: initialize auth in requirePermissions before projectId check (#10880)
• 06bd4c9 feat(crashlytics): add support for hidden source maps (#10868)
• af93f9e feat(appcheck): add appcheck:services commands for enforcement (#10887)
• 49b7ce6 fix typo in loginPrototyper having extra curly brace (#10890)
• 7cb6b4e feat(crashlytics): add crashlytics:onboard:web command (#10861)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.