chore: modernize jest and dependencies, fix path parameter security bug

[inlined]

Security Audit & Remediation: firestore-bundle-builder

A. Previous CVEs

• Multiple vulnerabilities in dependencies (e.g. underscore GHSA-qpx9-hpmf-5gmw, uuid GHSA-w5hq-g745-h8pq, ws GHSA-3h5v-q93c-6h6q, yargs-parser GHSA-p9pc-299p-vxgp, websocket-driver GHSA-mp7j-qc5w-4988, word-wrap GHSA-j8xg-fqg3-53r7).

B. Changes Made

• Changed the .map() path parameterization logic in parameterizePath to validate path segments, ensuring they don't contain any slashes (/), and throw HttpsError('invalid-argument', "Invalid argument provided for $part).
• Modernized Jest and dependencies to v29+, resolving several high/critical CVEs.
• Moved compile-time types/runners (@types/jest, jest, ts-jest, typescript, ts-node, tslint) to devDependencies.
• Updated firebase-functions to 7.3.0
• Updated firebase-admin to ^12.7.0, @google-cloud/firestore to ^7.7.0, and @google-cloud/storage to ^7.7.0.
• Promoted execution engine in extension.yaml from nodejs14 to nodejs18 and updated engines.node in package.json to >=22.
• Fixed a parameterization key mapping and relative path definition bug in tests to cleanly enable and run unit tests.

C. Remaining CVEs

• None directly in target dependencies.

D. Introduced CVEs

• None.

E. Testing Strategy

• Ran unit tests in bundle.test.ts (100% passing).
• Validated with the automated linter.

Release Notes

relnote: chore: modernize dependencies and fix path traversal vulnerability in path parameterizer

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	2  4
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	2  4

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[gemini-code-assist]

Code Review

This pull request upgrades the Node.js runtime to version 18, updates several dependencies, and introduces security enhancements to the path parameterization logic to prevent path injection and empty path parameters. A review comment points out that the check if (!val) in parameterizePath will incorrectly reject valid falsy values like 0 or false. It is recommended to explicitly check for undefined, null, or "" instead, as well as fix a misleading type annotation and a typo in the log messages.