SUPPLY-001C — Upgrade Firebase web SDK to the final 11.x compatibility set #202

Officer impact: No officer screen or procedure should change. This update replaces a vulnerable website dependency while preserving the same sign-in, account, Firestore, Functions, App Check, Analytics, and local-emulator behavior.

Officer documentation: None — this is a dependency-only compatibility boundary. Root security and operations records must still say exactly what was tested and whether anything was published.

Deployment evidence: None at issue creation. Closure must report the dependency graph, tests, merge, website publication, Firebase deployment, provider configuration, and production behavior as separate states. A green source workflow does not prove the updated website is live.

Problem

On exact main caae31ff427e91325d34a6c901faf81ad1dc49df, firebase declares ^10.7.1 and resolves to 10.14.1. A fresh Node 20 production audit reports 19 advisories: 1 critical, 5 high, 12 moderate, and 1 low. The Firebase/Firestore production graph reaches protobufjs@7.4.0, while the critical advisory covers versions through 7.6.2. Firebase 10 also brings the vulnerable undici@6.19.7 line into several client packages.

Firebase's official version 11 release notes say that v11 requires Node 18 or newer, emits ES2017 rather than ES5, and removes undici and node-fetch from its Node bundles: https://firebase.google.com/support/release-notes/js#version_1100_-_october_21_2024 . This repository already standardizes on Node 20 and modern browsers.

Atomic outcome

Upgrade exactly one Firebase web-SDK compatibility boundary:

• firebase@11.10.0, the final stable 11.x release;
• @firebase/rules-unit-testing@4.0.1, the matching Firebase 11 test peer;
• one clean compatible lock graph with the production protobuf path at 7.6.3 or newer.

Do not jump to Firebase 12, add a direct protobuf workaround, run a forced audit rewrite, or mix Firebase Admin/Functions upgrades into this issue.

Security and compatibility invariants

• The website keeps the existing modular Firebase API. No provider, project, emulator, Auth, Firestore, Functions, Analytics, or App Check configuration changes.
• Browser development/test remains fail-closed to the Auth, Firestore, and Functions emulators.
• App Check remains Enterprise-only and does not initialize on the initial private action/callback route.
• Analytics remains suppressed on private callback/capability routes.
• No Firebase 10 package remains in the application client graph, and the rules test package has a valid Firebase 11 peer.
• The production graph contains no critical advisory and no unexplained new high advisory.
• The lockfile contains only registry-resolved package metadata and integrity values. No override or direct transitive pin is added unless ordinary compatible resolution fails and a separately reviewed scope amendment is posted.
• No secret, production record, real member, mailbox, payment, or provider call is used.

Scope

• package.json
• package-lock.json
• minimum exact status updates in SECURITY.md, OPERATIONS_RUNBOOK.md, GITHUB_ISSUES.md, and GITHUB_ISSUE_SLICES.md

Existing runtime and test source are verification targets, not initially owned edit paths. If a real API incompatibility appears, stop, post the exact failure, and split or explicitly amend scope before editing runtime behavior.

Acceptance criteria

• firebase is exactly 11.10.0 and @firebase/rules-unit-testing is exactly 4.0.1.
• A fresh Node 20 lockfile install succeeds with no invalid peer dependency.
• npm ls firebase @firebase/rules-unit-testing @grpc/proto-loader protobufjs --all shows one valid Firebase 11 client/test graph and production protobuf 7.6.3 or newer.
• Before/after production audits are recorded; the root production audit has no critical finding and no unexplained new high finding.
• Focused Firebase resource tests prove emulator isolation, Enterprise App Check, callback startup suppression, and callback Analytics suppression.
• Full frontend Jest, SPA callback, Firestore Rules emulator, Functions, artifact/workflow safety, non-mutating lint, and diagnostic production build checks pass.
• The optimized bundle diff is reviewed for unexpected server modules, credentials, or major unexplained growth.
• Root security/operations/issue documentation states exact source/test/merge/live status without claiming the website, Firebase, or provider was changed.

Dependencies and coordination

• Catalogued dependency CI-001A is complete through CI-001A — Repair the deterministic frontend test baseline #103.
• SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99/CI-001B1A — Run SPA callback safety tests in hosted CI #126 provide the emulator/callback baselines.
• OBS-001A2 — Disable unapproved Firebase Analytics collection #139 provides Analytics suppression tests.
• ABUSE-001A1 — Use reCAPTCHA Enterprise for browser App Check #159 provides Enterprise App Check source/tests.
• SUPPLY-001B — Patch React Router 6 and resolve future flags #192 completed the separate React Router patch and released package/lock ownership.
• SUPPLY-001D owns the later Firebase Admin/Functions upgrade; do not edit functions/package*.json here.
• SUPPLY-001G owns future dependency/secret scanning, audit policy, SBOM, and update automation; do not make this issue a general supply-chain workflow change.

Explicitly out of scope

• Firebase 12, Firebase Admin/Functions SDK upgrades, CRA replacement, dependency bot/scanner workflows, audit-exception policy, SBOM, provider console changes, project migration, deployment, production data, or live verification.
• Claiming the old development-tool graph is fully clean if Firebase CLI or another dev-only package retains a separate advisory.

Claim protocol

Creation is not a claim. Before editing, assign the issue, post CLAIMED by <canonical agent> at <UTC>; branch <branch>, and re-read live comments. Keep the change to this one compatibility boundary.