Firestore 9.4.0: request supported fix for transitive glob/minimatch security advisories #9805

Summary

@google-cloud/firestore@9.4.0, installed through firebase-admin@14.5.0, resolves older Google Cloud dependencies that retain rimraf@5 → glob@10 → minimatch@9.

This causes production dependency audit findings for:

• [GHSA-3g3m-2fjr-6pw4](GHSA-3g3m-2fjr-6pw4) — glob
• [GHSA-g3hv-75wg-m249](GHSA-g3hv-75wg-m249) — minimatch

We are requesting a maintainer-supported dependency update rather than forcing incompatible major-version overrides.

Environment

• Node.js 22
• npm 11
• firebase-admin@14.5.0
• @google-cloud/firestore@9.4.0
• @google-cloud/firestore-api@0.2.0
• google-gax@5.0.8
• Nested gaxios@7.1.3
• rimraf@5.0.10
• glob@10.5.0
• minimatch@9.0.9

Observed dependency chain

firebase-admin@14.5.0
└── @google-cloud/firestore@9.4.0
    └── @google-cloud/firestore-api@0.2.0
        └── google-gax@5.0.8
            └── rimraf@5.0.10
                └── glob@10.5.0
                    └── minimatch@9.0.9

A separate nested gaxios dependency also retains rimraf 5.

This is a condensed dependency relationship from a locked runtime graph, not a runtime execution trace.

Why an ordinary update does not resolve the findings

The declared package ranges include:

• Firestore 9.4.0 → Firestore API ^0.2.0
• Firestore API 0.2.0 → google-gax ^5.0.0
• rimraf 5 → glob ^10.3.7
• glob 10.5.0 → minimatch ^9.0.4

The published security fixes begin at glob 14.0.2 and minimatch 11.0.1, outside those ranges.

Suggested reproduction

Using an empty directory:

npm init -y
npm install --save-exact --ignore-scripts firebase-admin@14.5.0 @google-cloud/firestore@9.4.0
npm ls @google-cloud/firestore @google-cloud/firestore-api google-gax gaxios rimraf glob minimatch --all
npm audit --omit=dev

These are suggested reproduction commands using public packages. Registry resolutions may change.

Compatibility experiments

We separately tested:

1. Overriding Firestore API 0.2.0 with 0.7.1.
2. Retaining Firestore API 0.2.0 while overriding google-gax 5.x with 6.14.0.

Both experiments produced zero findings in the isolated Node 22 runtime audit and passed 72 distinct regression tests (84 executions).

However, both changes cross the upstream packages' declared dependency ranges. Emulator success does not establish full API compatibility or real Google Cloud production compatibility.

Neither configuration was adopted for release.

Related upstream issues

• google-gax: rimraf appears build-only but is published as a production dependency (pulls vulnerable brace-expansion chain) #8969 — google-gax includes an apparently build-only rimraf dependency.
• rimraf is an unused production dependency in gax and gaxios #8975 — rimraf appears unused as a production dependency in gax and gaxios.
• Update gaxios to 7.2.0 in gcp-metadata #8868 — gcp-metadata retains an older gaxios version containing rimraf.

These reports concern earlier dependency problems but appear relevant to the current advisories.

Requested maintainer guidance

1. Can a supported Firestore 9.x release update its generated Firestore API dependency to a compatible version using a safe google-gax/gaxios dependency tree?
2. Could the older Google Cloud dependencies receive supported patches removing unused rimraf production dependencies?
3. Can affected gcp-metadata dependencies move away from exact older gaxios pins where compatible?
4. Is there an officially supported Firestore / Firestore API / google-gax version combination that clears these findings on Node 22?
5. Which versions and migration steps should downstream users adopt?

We would appreciate guidance on the smallest supported dependency update that resolves these advisories without unsupported major-version overrides.