Release the security-audit dependency PRs (#2881–#2888)

[cabljac]

Release the security-audit dependency PRs

Eight approved (lgtm) security-audit PRs are merged/ready but inert — they land code only. They do nothing for users until each extension is version-bumped and published. None of them touch extension.yaml or CHANGELOG.md.

Per-extension release steps (each)

• Bump version: in extension.yaml
• Add CHANGELOG.md entry
• Publish to the Extensions registry

PRs to release

• Security Audit & Remediation: delete-user-data #2881 delete-user-data — drop node-fetch → global fetch
• Security Audit & Remediation: firestore-send-email #2882 firestore-send-email — bump nodemailer ^9.0.1
• Security Audit & Remediation: firestore-counter #2883 firestore-counter — drop deep-equal → util.isDeepStrictEqual, uuid → crypto.randomUUID()
• Security Audit & Remediation: firestore-shorten-urls-bitly #2884 firestore-shorten-urls-bitly
• Security Audit & Remediation: rtdb-limit-child-nodes #2885 rtdb-limit-child-nodes (also switches firebase-functions → firebase-functions/v1)
• Security Audit & Remediation: firestore-translate-text #2886 firestore-translate-text
• Security Audit & Remediation: storage-resize-images #2887 storage-resize-images — drop mkdirp/uuid/uuidv4 → Node builtins
• Security Audit & Remediation: firestore-bigquery-export #2888 firestore-bigquery-export — drop node-fetch → global fetch

Common to all: npm audit fix dependency bumps + remove unmaintained rimraf (clean script now uses native fs.rmSync).

Remaining (unfixed) transitive CVEs — do NOT claim full clearance in release notes

• uuid@<11.1.1 — pinned under firebase-admin > @google-cloud/firestore > google-gax (and @google-cloud/bigquery). Needs upstream bump.
• ts-deepmerge@<8.0.0 — devDep under firebase-functions-test. Test-only, breaking upstream.

Verification done at review

• All 8 reviewed; runtime is nodejs22 across the board (global fetch + crypto.randomUUID() both stable).
• Security Audit & Remediation: firestore-counter #2883 test-validated: CI suite green; deep-equal → isDeepStrictEqual shown to have no behavioral divergence vs base.

[cabljac]

Status update: the eight security-audit PRs are reviewed and merged but inert until each extension is version-bumped and published, since none touch extension.yaml or CHANGELOG.md. Next step is to run the per-extension release (version bump, changelog entry, publish) for all eight. Note for release notes: we should not claim full CVE clearance, as the transitive uuid@<11.1.1 (pinned under firebase-admin/google-gax) and dev-only ts-deepmerge@<8.0.0 remain outstanding pending upstream bumps. We'll track the publishes off this issue.

[CorieW]

Tracked - on the script-work backlog