[russellwheatley]

Combines open Dependabot PRs onto one branch.

Included

• actions/checkout 6.0.2 to 7.0.1, actions/setup-node 6.3.0 to 7.1.0, actions/setup-java 5.2.0 to 6.0.1, actions/setup-go 5.6.0 to 7.0.0 (SHA pinned, existing pins kept). The checkout v7 fork-PR block only affects pull_request_target/workflow_run, and pr_title.yml doesn't check out code.
• functions/package-lock.json: brace-expansion, proxy-addr, @babel/core, markdown-it, jsdoc, express, path-to-regexp
• functions moved from Node 18 to Node 22 (engines.node), which unblocks:
  • firebase-admin 11 to 14
  • firebase-functions 4 to 7 (first version whose peer range allows firebase-admin 14)
  • sharp 0.32 to 0.35
• Source/config changes needed for the new versions: import sharp from "sharp" (also updated in docs/firebase-ui-storage/storage-image.md), and esModuleInterop + skipLibCheck in functions/tsconfig.json.
• Removed firebase-functions-test: unused, and its latest peer range stops at firebase-admin 13.

Intentionally skipped

• chore(deps): bump melos from 4.1.0 to 8.9.0 #695 (melos 4 to 8): major bump, likely needs release process changes

Obsoletes

• Obsoletes: chore(deps): bump actions/checkout from 4.1.1 to 7.0.1 #713
• Obsoletes: chore(deps): bump actions/setup-go from 5 to 7 #714
• Obsoletes: chore(deps): bump actions/setup-java from 4.0.0 to 6.0.1 #715
• Obsoletes: chore(deps): bump actions/setup-node from 4.0.1 to 7.1.0 #716
• Obsoletes: chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 in /functions #722
• Obsoletes: chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /functions #725
• Obsoletes: chore(deps-dev): bump @babel/core from 7.21.8 to 7.29.7 in /functions #706
• Obsoletes: chore(deps): bump markdown-it and jsdoc in /functions #711
• Obsoletes: chore(deps): bump path-to-regexp and express in /functions #724
• Obsoletes: chore(deps): bump @fastify/busboy and firebase-admin in /functions #726
• Obsoletes: chore(deps): bump @grpc/grpc-js, firebase-admin, firebase-functions and firebase-functions-test in /functions #718
• Obsoletes: chore(deps): bump sharp from 0.32.6 to 0.35.5 in /functions #723

[gemini-code-assist]

Code Review

This pull request updates the package-lock.json file in the functions directory, upgrading several dependencies including Babel packages, Express, JSDoc, Markdown-it, and other utility libraries, while also removing unused transitive dependencies such as fsevents and to-fast-properties. There are no review comments provided, so I have no feedback to offer.