fix(security): fix CodeQL vulnerabilities and modernize vitest deps

[Manvi1203]

Description

This PR resolves 33 security vulnerabilities identified in GitHub Code Scanning (CodeQL and dependency security advisories).

A new changeset has been added for @firebase/util to publish the prototype pollution fix: .changeset/prevent-prototype-pollution.md.

---

Vulnerability & Alert Resolution Summary

Vulnerability Resolved	Alert(s) Resolved	The Problem (Root Cause)	The Fix Applied
js/prototype-pollution-utility	Alert #10	isValidKey only checked key !== '__proto__'. Passing {"constructor": {"prototype": {...}}} traversed through constructor to modify Object.prototype.	Blocked constructor and prototype in packages/util/src/deepCopy.ts#L80. Added unit test coverage in packages/util/test/deepCopy.test.ts#L114-L124 and added new changeset prevent-prototype-pollution.md.
js/prototype-polluting-assignment	Alert #100	populatePath dynamically traversed nested object properties using untrusted path segments from Data Connect extension payloads without prototype boundary checks.	Added early bail-out guard in packages/data-connect/src/cache/cacheUtils.ts#L44-L51 if pathSegment equals '__proto__', 'constructor', or 'prototype'.
js/incomplete-sanitization	Alert #5	onSecurityDebugPacket_ called .replace('\n', '\nFIREBASE: '), replacing only the first newline character in multiline debug packets.	Replaced string literal with global regex replace(/\n/g, '\nFIREBASE: ') in packages/database/src/core/PersistentConnection.ts#L1029.
js/incomplete-hostname-regexp & js/incomplete-sanitization	Alert #7, Alert #30, Alert #31	cloudStorageHost regex had unescaped dots in domain patterns (storage.googleapis.com), allowing spoofed domains (e.g. storageXgoogleapisYcom). Also custom host sanitization only escaped . instead of all metacharacters.	Escaped domain dots (storage\\.googleapis\\.com, storage\\.cloud\\.google\\.com) and applied full regex metacharacter escaping in packages/storage/src/implementation/location.ts#L92-L104.
js/incomplete-sanitization	Alert #3	validateOrigin only escaped dots (replace(/\./g, '\\.')) before constructing dynamic RegExp, leaving +, *, ?, `	` unescaped.
js/incomplete-hostname-regexp	Alert #28	testRepoInfo test helper regex /https?:\/\/(.*).firebaseio.com/ had an unescaped dot before firebaseio.com.	Escaped dot: /https?:\/\/(.*?)\.firebaseio\.com/ in packages/database/test/helpers/util.ts#L68.
js/incomplete-sanitization	Alert #1058	standalonePkg.main.replace('../', '') in Rollup build config only stripped the first ../ occurrence.	Converted to global regex replace(/\.\.\//g, '') in packages/database-compat/rollup.config.js#L122.
js/incomplete-sanitization	Alert #2	Demo script constructed dynamic RegExp with incomplete escaping, exposing URL parsing to regex injection and ReDoS.	Replaced custom regex with new URL(window.location.href).searchParams.get(name) in packages/auth/demo/src/index.js#L1800-L1806.
js/incomplete-multi-character-sanitization	Alert #9	Single .replace(/\.\.\//g, '') allowed crafted strings like ..././ to collapse into ../ after replacement.	Implemented recursive sanitization loop while (flattenedLinks.includes('../')) in scripts/docgen-compat/generate-docs.js#L90-L93.
CVE-2026-26996, CVE-2026-27903, CVE-2026-27904	Alert #640, Alert #641, Alert #642	ReDoS in Transitive minimatch@9.0.3: Hard-pinned by deprecated @typescript-eslint/eslint-plugin-tslint: 7.0.2 and dead tslint toolchain.	Pruned deprecated tslint plugin and dependencies from config/.eslintrc.js#L15-L27 and package.json#L74-L78, completely removing vulnerable minimatch@9.0.3 from yarn.lock.
CVE-2026-84373	Alert #1369, Alert #1372	ReDoS vulnerability in Vitest mocker < 4.1.11.	Direct devDependency bump of vitest and @vitest/browser-playwright to 4.1.11 in package.json#L109-L113 and yarn.lock.
CVE-2026-82417, CVE-2026-82562	Alert #1350, Alert #1351, Alert #1356, Alert #1357, Alert #1358, Alert #1359, Alert #1360, Alert #1361, Alert #1362, Alert #1363, Alert #1364, Alert #1365 (12 alerts)	Unbounded depth and prototype parsing in qs <= 6.15.3.	In-range upgrade of qs to 6.16.0 across all 5 workspace lockfiles: yarn.lock, config/functions/yarn.lock, e2e/smoke-tests/yarn.lock, packages/auth/demo/functions/yarn.lock, and packages/rules-unit-testing/functions/yarn.lock.
CVE-2026-84375	Alert #1368	Parsing crafted YAML objects in js-yaml < 3.15.2 polluted object prototypes.	In-range upgrade of js-yaml@^3.13.1 to 3.15.2 in e2e/smoke-tests/yarn.lock.
CVE-2026-45736, CVE-2026-48779	Alert #837, Alert #1002	Vulnerabilities in WebSocket frame parsing in ws <= 8.17.1.	In-range upgrade of socket.io-adapter from 2.5.5 to 2.5.8 (matching ~2.5.2 in socket.io@4.8.1), pulling secured ws@8.21.3 in yarn.lock.
CVE-2026-42338, CVE-2026-69192	Alert #625, Alert #1206	HTML injection and catastrophic backtracking in IPv6 regexes in ip-address 9.x.	In-range upgrade of socks from 2.8.3 to 2.8.10 (matching ^2.8.3 in socks-proxy-agent), resolving to secure ip-address@10.7.0 in yarn.lock.

[changeset-bot]

🦋 Changeset detected

Latest commit: 5f0f856

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 30 packages

Name	Type
@firebase/util	Patch
@firebase/ai	Patch
@firebase/analytics-compat	Patch
@firebase/analytics	Patch
@firebase/app-check-compat	Patch
@firebase/app-check	Patch
@firebase/app-compat	Patch
@firebase/app	Patch
@firebase/auth-compat	Patch
@firebase/auth	Patch
@firebase/component	Patch
@firebase/data-connect	Patch
@firebase/database-compat	Patch
@firebase/database-types	Patch
@firebase/database	Patch
firebase	Patch
@firebase/firestore-compat	Patch
@firebase/firestore	Patch
@firebase/functions-compat	Patch
@firebase/functions	Patch
@firebase/installations-compat	Patch
@firebase/installations	Patch
@firebase/messaging-compat	Patch
@firebase/messaging	Patch
@firebase/performance-compat	Patch
@firebase/performance	Patch
@firebase/remote-config-compat	Patch
@firebase/remote-config	Patch
@firebase/storage-compat	Patch
@firebase/storage	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Changeset File Check ⚠️

• Warning: This PR modifies files in the following packages but they have not been included in the changeset file:%0A - @firebase/auth%0A - @firebase/data-connect%0A - @firebase/database-compat%0A - @firebase/database%0A - @firebase/rules-unit-testing%0A - @firebase/storage%0A%0A Make sure this was intentional.

[gemini-code-assist]

Code Review

This pull request focuses on security improvements, dependency updates, and code cleanups. Key changes include preventing prototype pollution in deepExtend and populatePath, removing deprecated tslint configurations, updating several dependencies (such as qs and vitest), and fixing regex escaping and global replacement issues across multiple packages. Regarding the feedback, the reviewer pointed out that simplifying getParameterByName using URL.searchParams in the auth demo could break compatibility with hash-based routing query parameters, and provided a robust fallback solution.