Merge master into release

.changeset/selfish-donkeys-cheer.md

@@ -0,0 +1,5 @@
+---
+'firebase': patch
+---
+
+Fix glob pattern to work with Node 20 and its NPM version.

.changeset/thirty-otters-hug.md

@@ -0,0 +1,5 @@
+---
+'@firebase/auth': patch
+---
+
+Fix possible XSS vulnerability through **FIREBASE_DEFAULTS** settings.

.changeset/violet-ways-judge.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/canary-deploy.yml

@@ -31,10 +31,10 @@ jobs:
       with:
         # Canary release script requires git history and tags.
         fetch-depth: 0
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Deploy canary

.github/workflows/check-changeset.yml

@@ -34,10 +34,10 @@ jobs:
       with:
         # This makes Actions fetch all Git history so check_changeset script can diff properly.
         fetch-depth: 0
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Run changeset script

.github/workflows/check-docs.yml

@@ -27,10 +27,10 @@ jobs:
       with:
         # get all history for the diff
         fetch-depth: 0
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Run doc generation (devsite docs)

.github/workflows/check-pkg-paths.yml

@@ -27,10 +27,10 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Yarn build

.github/workflows/deploy-config.yml

@@ -34,10 +34,10 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
-    - name: Set up node (18)
+    - name: Set up node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 18.x
+        node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Deploy project config if needed

.github/workflows/e2e-test.yml

@@ -36,10 +36,10 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@master
-      - name: Set up Node (18)
+      - name: Set up Node (20)
         uses: actions/setup-node@master
         with:
-          node-version: 18.x
+          node-version: 20.x
       - name: install Chrome stable
         run: |
           sudo apt-get update

.github/workflows/format.yml

@@ -31,10 +31,10 @@ jobs:
       with:
         # get all history for the diff
         fetch-depth: 0
-    - name: Set up node (16)
+    - name: Set up node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Run formatting script

.github/workflows/health-metrics-pull-request.yml

@@ -41,7 +41,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
       - uses: 'google-github-actions/auth@v0'
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
@@ -58,7 +58,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
       - uses: 'google-github-actions/auth@v0'
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'

.github/workflows/lint.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
-    - name: Set up node (16)
+    - name: Set up node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: yarn install
       run: yarn
     - name: yarn lint

.github/workflows/prerelease-manual-deploy.yml

@@ -34,10 +34,10 @@ jobs:
           with:
             # Canary release script requires git history and tags.
             fetch-depth: 0
-        - name: Set up node (16)
+        - name: Set up node (20)
           uses: actions/setup-node@v3
           with:
-            node-version: 16.x
+            node-version: 20.x
         - name: Yarn install
           run: yarn
         - name: Deploy prerelease

.github/workflows/release-log.yml

@@ -28,10 +28,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@master
 
-      - name: Setup Node.js 16.x
+      - name: Setup Node.js 20.x
         uses: actions/setup-node@master
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Get PR number and send to tracker.
         run: node scripts/ci/log-changesets.js

.github/workflows/release-pr.yml

@@ -32,10 +32,10 @@ jobs:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
 
-      - name: Setup Node.js 16.x
+      - name: Setup Node.js 20.x
         uses: actions/setup-node@master
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install Dependencies
         run: yarn

.github/workflows/release-prod.yml

@@ -32,10 +32,10 @@ jobs:
       contents: write
 
     steps:
-    - name: Set up node (16)
+    - name: Set up node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Checkout release branch (with history)
       uses: actions/checkout@master
       with:

.github/workflows/release-staging.yml

@@ -46,10 +46,10 @@ jobs:
     # Block this workflow if run on a non-release branch.
     if: github.event.inputs.release-branch == 'release' || endsWith(github.event.inputs.release-branch, '-releasebranch')
     steps:
-    - name: Set up node (16)
+    - name: Set up node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Merge master into release
       uses: actions/github-script@v6
       with:

.github/workflows/release-tweet.yml

@@ -34,10 +34,10 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@master
-      - name: Setup Node.js 16.x
+      - name: Setup Node.js 20.x
         uses: actions/setup-node@master
         with:
-          node-version: 16.x
+          node-version: 20.x
       - name: Poll release notes page on devsite
         run: node scripts/ci/poll_release_notes.js
         env:

.github/workflows/test-all.yml

@@ -42,10 +42,10 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - uses: actions/checkout@v3
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Test setup and yarn install
       run: |
         cp config/ci.config.json config/project.json
@@ -81,10 +81,10 @@ jobs:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Test setup and yarn install
       run: |
         cp config/ci.config.json config/project.json
@@ -132,10 +132,10 @@ jobs:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Test setup and yarn install
       run: |
         cp config/ci.config.json config/project.json
@@ -175,10 +175,10 @@ jobs:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Test setup and yarn install
       run: |
         cp config/ci.config.json config/project.json
@@ -219,10 +219,10 @@ jobs:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - run: cp config/ci.config.json config/project.json
     - run: yarn
     - run: yarn build:${{ matrix.persistence }}

.github/workflows/test-changed-auth.yml

@@ -56,10 +56,10 @@ jobs:
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
-      - name: Set up Node (16)
+      - name: Set up Node (20)
         uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
       - name: Test setup and yarn install
         run: |
           cp config/ci.config.json config/project.json
@@ -88,10 +88,10 @@ jobs:
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
-      - name: Set up Node (16)
+      - name: Set up Node (20)
         uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
       - name: Test setup and yarn install
         run: |
           cp config/ci.config.json config/project.json

.github/workflows/test-changed-fcm-integration.yml

@@ -38,10 +38,10 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: Test setup and yarn install
       run: |
         cp config/ci.config.json config/project.json

.github/workflows/test-changed-firestore-integration.yml

@@ -63,10 +63,10 @@ jobs:
         rm -f "$output_file"
       continue-on-error: true
 
-    - name: Set up Node (16)
+    - name: Set up Node (20)
       uses: actions/setup-node@v3
       with:
-        node-version: 16.x
+        node-version: 20.x
     - name: install Chrome stable
       run: |
         sudo apt-get update