[mtrezza]

Lock-file-only update of @tootallnate/once from 2.0.0 to 2.0.1.

The lock file had two copies of 2.0.0, both production and optional:

• node_modules/@google-cloud/storage/node_modules/@tootallnate/once
• node_modules/retry-request/node_modules/@tootallnate/once

Each copy belongs to a teeny-request 9.0.0 → http-proxy-agent 5.0.0 pair, and http-proxy-agent declares "@tootallnate/once": "2". Three paths reach them, all through optional dependencies of firebase-admin 13.9.0:

• firebase-admin → @google-cloud/storage 7.19.0 → teeny-request 9.0.0 → http-proxy-agent 5.0.0 → @tootallnate/once (the @google-cloud/storage copy)
• firebase-admin → @google-cloud/storage 7.19.0 → retry-request 7.0.2 → teeny-request 9.0.0 → http-proxy-agent 5.0.0 → @tootallnate/once (the retry-request copy)
• firebase-admin → @google-cloud/firestore 7.11.0 → google-gax 4.4.1 → retry-request 7.0.2 → teeny-request 9.0.0 → http-proxy-agent 5.0.0 → @tootallnate/once (the same retry-request copy)

No other package in the lock file depends on @tootallnate/once.

After this PR there is a single copy, 2.0.1, at node_modules/@tootallnate/once. Both http-proxy-agent 5.0.0 copies resolve it from there; npm ls @tootallnate/once --omit=dev shows 2.0.1 under both.

Security

Dependabot alert resolved by this PR:

Alert	Severity	Scope	Advisory	Vulnerable range
alert 179	low	runtime	GHSA-vpq2-c234-7xj6 (CVE-2026-3449)	< 2.0.1

The advisory: when once() is called with the signal option and the signal is aborted, the returned promise stays pending forever, so any await or .then() on it hangs.

How the advisory reaches this package: it doesn't. There are three separate reasons.

• The adapter imports only firebase-admin/app and firebase-admin/messaging. firebase-admin loads @google-cloud/storage only from lib/storage and @google-cloud/firestore only from lib/firestore. These modules load through firebase-admin/storage and firebase-admin/firestore, or on demand through the namespace storage and firestore getters. A static trace of the require calls reachable from firebase-admin/app and firebase-admin/messaging reaches neither, so the adapter never loads @tootallnate/once.
• Even where Cloud Storage or Firestore is used, teeny-request only loads http-proxy-agent when a proxy applies to the request (proxy option or HTTP_PROXY / HTTPS_PROXY, not excluded by NO_PROXY) and the URI starts with http://. Proxied https:// requests use https-proxy-agent 5, which doesn't depend on @tootallnate/once.
• http-proxy-agent 5.0.0 calls once(socket, 'connect') without options (dist/agent.js), so signal is never set and the changed code doesn't run.

Empirical check

The published dist/index.js of both versions ran side by side in Node.js 22.19.0:

Call	2.0.0 (master)	2.0.1 (this PR)
once(emitter, 'connect'), then connect is emitted (the http-proxy-agent call)	Resolves with [], no listeners left	Same
once(emitter, 'connect'), then error is emitted	Rejects with the emitted error, no listeners left	Same
once(emitter, 'connect', { signal }), then the signal is aborted	Stays pending	Rejects with AbortError: The operation was aborted
once(emitter, 'connect', { signal }) with an already aborted signal	Ignores the signal: keeps its 2 listeners on the emitter and resolves if connect is emitted later	Rejects with AbortError: The operation was aborted, no listeners added

Changes

@tootallnate/once 2.0.0 → 2.0.1

• 2.0.1: Fix promise hang when AbortSignal is aborted (release notes). From the published tarballs:
  • When the signal is aborted, once() now removes its listeners and rejects with an Error named AbortError (message The operation was aborted). Before, it only removed the listeners and the promise stayed pending.
  • If the signal is already aborted when once() is called, it now rejects right away without adding listeners. 2.0.0 ignored such a signal.
  • Type declarations: the AbortSignal interface in dist/types.d.ts gains aborted: boolean, and export declare type becomes export type in dist/types.d.ts and dist/overloaded-parameters.d.ts. This only affects TypeScript consumers.
  • package.json: release scripts and the @changesets/cli dev dependency were added, and the repository URL now uses https. There are still no runtime dependencies, and engines is unchanged.

Lock file

Generated with npm update @tootallnate/once --ignore-scripts --package-lock-only (npm 10.9.3). npm removed the two nested 2.0.0 entries and added one 2.0.1 entry at node_modules/@tootallnate/once, in both the packages and the lockfileVersion 2 dependencies sections. The new entry also records "license": "MIT", which npm writes for new entries. No other entry changes.

2.0.1 declares the same Node.js engine range as 2.0.0 (>= 10). The supported Node.js versions don't change. CI tests Node.js 20, 22 and 24.

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement. The only behavior change applies when a caller passes signal, and no caller in this dependency tree does.

Summary by CodeRabbit

• Chores
  • Updated project installation records to keep setup information consistent. No user-facing changes are included.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 2664cdc8-cf92-447c-8c7c-05b935de7401

Commits

Reviewing files that changed from the base of the PR and between 5e89e9c and 06359bc.

Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Walkthrough

The lockfile now records @tootallnate/once 2.0.1 as a top-level dependency and removes nested 2.0.0 records under Google Cloud Storage and retry-request in both lockfile representations.

Changes: Dependency lockfile update

Layer / File(s)	Summary
Update dependency lock records package-lock.json	The lockfile adds top-level records for @tootallnate/once 2.0.1 and removes nested 2.0.0 records under Google Cloud Storage and retry-request in both representations.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: Minimal · up to 06359

No merge-blocking issue remains in this dependency-only update.

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

Failed checks: 1 error

Check name	Status	Explanation	Resolution
Description check		The description is thorough and technically detailed. It explains the lock-file change, the dependency paths, the Dependabot alert (GHSA-vpq2-c234-7xj6 / CVE-2026-3449), the reasoning why the adapter …	Restructure the description to match the repository template. Add the header lines: report security issues confidentially (link to the security policy) and the contribution license statement (link to the LICENSE file). Add an '## Issue' sec…

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title begins with the allowed fix: prefix and uses a capitalized first word. It accurately describes the dependency update.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		PASS. The authoritative diff changes only package-lock.json. It removes two @tootallnate/once 2.0.0 records and adds one integrity-pinned 2.0.1 record. Both existing http-proxy-agent dependency …
Engage In Review Feedback		No review feedback comments or actionable findings were supplied. Therefore, there was no feedback that the contributor needed to acknowledge, implement, or discuss.

Full details: Security Check

Explanation

PASS. The authoritative diff changes only package-lock.json. It removes two @tootallnate/once 2.0.0 records and adds one integrity-pinned 2.0.1 record. Both existing http-proxy-agent dependency ranges remain "2", so they resolve to 2.0.1. No executable code or new security-sensitive pattern is introduced.

Full details: Description check

Explanation

The description is thorough and technically detailed. It explains the lock-file change, the dependency paths, the Dependabot alert (GHSA-vpq2-c234-7xj6 / CVE-2026-3449), the reasoning why the adapter is not affected, the empirical test results, and breaking-change and code-change status. It does not follow the repository template. The Issue and Approach sections are missing, the Tasks checklist (Add tests, Add changes to documentation) is absent, and the required license and security-policy header lines are not present.

Resolution

Restructure the description to match the repository template. Add the header lines: report security issues confidentially (link to the security policy) and the contribution license statement (link to the LICENSE file). Add an '## Issue' section. Reference the Dependabot alert or advisory there, and state the problem it addresses. Rename or map the current content into '## Approach' so it describes the changes in this PR. Add a '## Tasks' section with the checklist items 'Add tests' and 'Add changes to documentation (guides, repository pages, code comments)'. Check the items that apply, or delete the ones that do not. For this lock-file-only change, state whether tests were added or why none were needed, and state that no documentation changes are needed.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.18%. Comparing base (5e89e9c) to head (06359bc).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #638   +/-   ##
=======================================
  Coverage   99.18%   99.18%           
=======================================
  Files          11       11           
  Lines        1841     1841           
=======================================
  Hits         1826     1826           
  Misses         15       15           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 8.5.9