Update form-data transitive dep to non-vulnerable version;

package.json

@@ -107,7 +107,7 @@
     "@electric-sql/pglite": "^0.3.3",
     "@electric-sql/pglite-tools": "^0.2.8",
     "@google-cloud/cloud-sql-connector": "^1.3.3",
-    "@google-cloud/pubsub": "^4.5.0",
+    "@google-cloud/pubsub": "^4.11.0",
     "@inquirer/prompts": "^7.4.0",
     "@modelcontextprotocol/sdk": "^1.10.2",
     "abort-controller": "^3.0.0",
@@ -209,7 +209,7 @@
     "@types/mock-fs": "4.13.4",
     "@types/multer": "^1.4.3",
     "@types/node": "^18.19.1",
-    "@types/node-fetch": "^2.5.12",
+    "@types/node-fetch": "^2.6.13",
     "@types/pg": "^8.11.2",
     "@types/progress": "^2.0.3",
     "@types/react": "^18.2.58",

src/apiv2.ts

@@ -15,8 +15,8 @@
 
 // Using import would require resolveJsonModule, which seems to break the
 // build/output format.
 const pkg = require("../package.json");
 const CLI_VERSION: string = pkg.version;
 
 export const STANDARD_HEADERS: Record<string, string> = {
   Connection: "keep-alive",
@@ -124,7 +124,7 @@
 
 /**
  * Gets a singleton access token
  * @returns An access token
  */
 export async function getAccessToken(): Promise<string> {
   const valid = auth.haveValidTokens(refreshToken, []);
@@ -229,7 +229,7 @@
    * Makes a request as specified by the options.
    * By default, this will:
    *   - use content-type: application/json
    *   - assume the HTTP GET method
    *
    * @example
    * const res = apiv2.request<ResourceType>({
@@ -268,7 +268,7 @@
     }
     try {
       return await this.doRequest<ReqT, ResT>(internalReqOptions);
     } catch (thrown: any) {
       if (thrown instanceof FirebaseError) {
         throw thrown;
       }
@@ -277,7 +277,7 @@
       if (thrown instanceof Error) {
         err = thrown;
       } else {
         err = new Error(thrown);
       }
       throw new FirebaseError(`Failed to make request: ${err.message}`, { original: err });
     }
@@ -365,7 +365,13 @@
     }
 
     if (options.signal) {
-      fetchOptions.signal = options.signal;
+      fetchOptions.signal = {
+        ...options.signal,
+        reason: "",
+        throwIfAborted: () => {
+          throw new FirebaseError("Aborted");
+        },
+      };
     }
 
     let reqTimeout: NodeJS.Timeout | undefined;
@@ -374,7 +380,13 @@
       reqTimeout = setTimeout(() => {
         controller.abort();
       }, options.timeout);
-      fetchOptions.signal = controller.signal;
+      fetchOptions.signal = {
+        ...controller.signal,
+        reason: "",
+        throwIfAborted: () => {
+          throw new FirebaseError("Aborted");
+        },
+      };
     }
 
     if (typeof options.body === "string" || isStream(options.body)) {
@@ -414,8 +426,8 @@
           this.logRequest(options);
           try {
             res = await fetch(fetchURL, fetchOptions);
           } catch (thrown: any) {
             const err = thrown instanceof Error ? thrown : new Error(thrown);
             logger.debug(
               `*** [apiv2] error from fetch(${fetchURL}, ${JSON.stringify(fetchOptions)}): ${err}`,
             );

src/emulator/auth/operations.ts

@@ -38,6 +38,7 @@ import {
   BlockingFunctionEvents,
 } from "./state";
 import { MfaEnrollments, Schemas } from "./types";
+import { FirebaseError } from "../../error";
 
 /**
  * Create a map from IDs to operations handlers suitable for exegesis.
@@ -3134,7 +3135,13 @@ async function fetchBlockingFunction(
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(reqBody),
-      signal: controller.signal,
+      signal: {
+        ...controller.signal,
+        reason: "",
+        throwIfAborted: () => {
+          throw new FirebaseError("Aborted");
+        },
+      },
     });
     ok = res.ok;
     status = res.status;

src/emulator/taskQueue.ts

@@ -2,6 +2,7 @@ import AbortController from "abort-controller";
 import { EmulatorLogger } from "./emulatorLogger";
 import { RetryConfig, Task, TaskQueueConfig } from "./tasksEmulator";
 import { Emulators } from "./types";
+import { FirebaseError } from "../error";
 import fetch from "node-fetch";
 
 class Node<T> {
@@ -293,7 +294,13 @@ export class TaskQueue {
         headers["X-CloudTasks-TaskPreviousResponse"] = `${emulatedTask.metadata.previousResponse}`;
       }
       const controller = new AbortController();
-      const signal = controller.signal;
+      const signal = {
+        ...controller.signal,
+        reason: "",
+        throwIfAborted: () => {
+          throw new FirebaseError("Aborted");
+        },
+      };
       const request = fetch(emulatedTask.task.httpRequest.url, {
         method: "POST",
         headers: headers,