Bump tar, @angular/fire, @angular/cli and firebase-tools in /frontend-angular

[dependabot]

Bumps tar to 7.5.16 and updates ancestor dependencies tar, @angular/fire, @angular/cli and firebase-tools. These dependencies need to be updated together.

Updates tar from 7.4.3 to 7.5.16

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• 302f51f fix inconsequential typo in PENDINGLINKS symbol name
• 55dbb99 remove some uses of mutate-fs
• 87cc309 7.5.15
• 7aef486 fix: regression in pending links detection
• 6244eb3 7.5.14
• 9704d8c stricter protection against hardlinks preempting their targets
• 700734f update workflows and deps
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @angular/fire from 19.0.0 to 20.0.1

Release notes

Sourced from @​angular/fire's releases.

20.0.1

What's Changed

• fix: Avoid handling promise rejections twice in stability helper by @​atscott in angular/angularfire#3657

New Contributors

• @​atscott made their first contribution in angular/angularfire#3657

Full Changelog: angular/angularfire@20.0.0...20.0.1

20.0.0

What's Changed

• Peer on Angular v20
• Peer on firebase-tools v14

Full Changelog: angular/angularfire@19.2.0...20.0.0

20.0.0-rc.0

What's Changed

• Peer on Angular v20
• Peer on firebase-tools v14

Full Changelog: angular/angularfire@19.2.0...20.0.0-rc.0

19.2.0

What's Changed

• Add @angular/fire/ai entry for Firebase AI by @​nohe427 in angular/angularfire#3650

New Contributors

• @​nohe427 made their first contribution in angular/angularfire#3650

Full Changelog: angular/angularfire@19.1.0...19.2.0

19.1.0

What's Changed

• Added data connect to schematics by @​maneesht in angular/angularfire#3638

New Contributors

• @​maneesht made their first contribution in angular/angularfire#3638

Full Changelog: angular/angularfire@19.0.0...19.1.0

Commits

• eb99d8e fix: Avoid handling promise rejections twice in stability helper (#3657)
• c1c6af9 Preparing v20 release (#3655)
• 61fde1b 19.2.0 release (#3651)
• 20bee94 Add AI package (#3650)
• ec4e3bd Bump action, bump minor (#3644)
• da4d2d1 Added data connect to schematics (#3638)
• See full diff in compare view

Updates @angular/cli from 19.0.0 to 22.0.1

Release notes

Sourced from @​angular/cli's releases.

22.0.1

@​schematics/angular

Commit	Description
	fix browserMode option mapping in refactor-jasmine-vitest
	safely comment out multiline statements in refactor-jasmine-vitest
	use null objects and callbacks in karma-to-vitest migration

@​angular/cli

Commit	Description
	do not sort migrations of the same version alphabetically
	fallback to local package.json for schematic detection on first run
	isolate temporary package installation from parent pnpm workspace
	remove forceAuth and unscoped credential parsing
	validate registry option is a valid URL in ng add
	optimize update schematic registry query counts by fetching package metadata lazily

@​angular/build

Commit	Description
	allow disabling Vitest isolation from builder
	exclude JSON imports from Vite dependency optimization
	prevent concurrent stylesheet bundling esbuild context leaks
	restrict application builder output paths to output directory

22.0.0

@​schematics/angular

Commit	Description
	add migrate-karma-to-vitest update migration
	add migration to add istanbul-lib-instrument
	conditionally install istanbul coverage provider for Vitest migration
	migrate fake async to Vitest fake timers
	migrate fakeAsync's flush behavior when used in beforeEach
	rely on strict template default in generated workspaces
	set up fake timers in beforeEach instead of beforeAll
	stabilize refactor-jasmine-vitest schematic
	update TSConfig globals during karma to vitest migration
	add istanbul-lib-instrument to application/library generator dependencies
	add trusted-proxy-headers migration
	default components to OnPush change detection
	defer karma config deletion in Karma to Vitest migration
	preserve Jasmine stub-by-default semantics for bare spies
	replace deprecated ChangeDetectionStrategy.Default with Eager
	support spy call arguments migration in refactor-jasmine-vitest
	use service decorator in ng generate

@​angular/cli

Commit	Description
	add support for Node.js 26.0.0
	reflect new minimum supported Node version in ng.js

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

22.0.1 (2026-06-10)

@​angular/cli

Commit	Type	Description
b54e9a549	fix	do not sort migrations of the same version alphabetically
d33311612	fix	fallback to local package.json for schematic detection on first run
918102a93	fix	isolate temporary package installation from parent pnpm workspace
b048b5f4a	fix	remove forceAuth and unscoped credential parsing
277934035	fix	validate registry option is a valid URL in ng add
4510dae02	perf	optimize update schematic registry query counts by fetching package metadata lazily

@​schematics/angular

Commit	Type	Description
c80012294	fix	fix browserMode option mapping in refactor-jasmine-vitest
a9b6bd904	fix	safely comment out multiline statements in refactor-jasmine-vitest
12199df00	fix	use null objects and callbacks in karma-to-vitest migration

@​angular/build

Commit	Type	Description
89d1be979	fix	allow disabling Vitest isolation from builder
d45b84be9	fix	exclude JSON imports from Vite dependency optimization
e3cab4ddd	fix	prevent concurrent stylesheet bundling esbuild context leaks
bd413b0eb	fix	restrict application builder output paths to output directory

22.0.0 (2026-06-03)

Breaking Changes

• Node.js v20 is no longer supported. The minimum supported Node.js versions are now v22.22.0 and v24.13.1.
• The @angular-devkit/architect-cli package is no longer available. The architect CLI tool has been moved to the @angular-devkit/architect package.
• The experimental @angular-devkit/build-angular:jest and @angular-devkit/build-angular:web-test-runner builders have been removed.

@​angular/build

• The @angular/build:dev-server (ng serve) now assigns the highest priority to the PORT environment variable. This value will override any port configurations specified in angular.json or via the --port command-line flag. This includes the default port 4200.
• istanbul-lib-instrument is now an optional peer dependency. Projects using karma with code coverage enabled will need to ensure that istanbul-lib-instrument is installed. Note: ng update will automatically add this dependency during the update process.

... (truncated)

Commits

• 5a64af9 release: cut the v22.0.1 release
• b54e9a5 fix(@​angular/cli): do not sort migrations of the same version alphabetically
• b048b5f fix(@​angular/cli): remove forceAuth and unscoped credential parsing
• 3275b45 test(@​angular/cli): remove unscoped authentication test cases from registry t...
• da81e55 build: update cross-repo angular dependencies
• 56ac348 build: lock file maintenance
• 12199df fix(@​schematics/angular): use null objects and callbacks in karma-to-vitest m...
• 918102a fix(@​angular/cli): isolate temporary package installation from parent pnpm wo...
• e9b106e build: update cross-repo angular dependencies
• e3cab4d fix(@​angular/build): prevent concurrent stylesheet bundling esbuild context l...
• Additional commits viewable in compare view

Updates firebase-tools from 13.34.0 to 15.20.0

Release notes

Sourced from firebase-tools's releases.

v15.20.0

• Removed the prompt and backend deletion of Data Connect services during firebase deploy. (#10619)
• Fixes firebase init dataconnect failing with ENOEXEC when creating a new template app on some operating systems. (#10616)
• Support setting the Google Cloud Storage (GCS) test results bucket in apptesting:execute and appdistribution:distribute

v15.19.1

• Updated Firebase SQL Connect genAI features to use new Agent Service API
• Updated the Firebase Data Connect local toolkit to v3.4.10, which includes the following changes:
  • Extended client cache consistency validation to include conflicts with schema field names.

v15.19.0

• Updated Pub/Sub emulator to version 0.8.32
• Added support for 6 more iD providers in auth:import and auth:export commands
• Fixed issue where auth:export didn't escape double quotes for CSV format. (#3484)
• Fixes CloudSQLConnectorError: The connector was closed unhandled exception during Data Connect deployments. (#10555)
• Updated the Firebase Data Connect local toolkit to v3.4.9, which includes the following changes: (#10567)
  • Added support for nested mutations for literals and also variables that define an incomplete set of fields.
  • Fixed an issue in the JS Generated SDK where QueryFetchPolicy wasn't being respected.

v15.18.0

• Updated Pub/Sub emulator to version 0.8.31
• Resolves undefined regions earlier, during the build to backend resolution phase (#10471)
• Updated the Firebase Data Connect local toolkit to v3.4.8, which includes the following changes:
  • Fixed an issue in Dart code generation where nullable BigInt was not handled correctly.
  • Added support for nested 1:Many relational batch inserts.
  • Updated the Golang dependency version to 1.25.10.
• Default timeout for Dart functions is now 60 seconds when not explicitly set (#10501)
• Support secret environment variables for Cloud Run functions (#10489)
• Set requiredProjectBindings in AI Logic services (#10503)

v15.17.0

• Added support for creating search indexes for Firestore. (#10431)
• Fixed an issue where some MCP tools would error with "Invalid input: expected record, received array". (#10437)
• Fixed an issue causing errors when multiple Firestore databases were configured in firebase.json (#8114)
• Updated the Firebase Data Connect local toolkit to v3.4.7, which includes the following changes: (#10461)
  • Fix emulator crash when using uuidv4() on operations.
  • Support for _Data input types as variables with @allow(fields, maxCount) to constraint the input JSON, enabling batch mutations in admin SDK. Client SDK support will come soon.
• Increase supported range for Next.js to version 16.0 (#9463)
• Updated Cloud Function default resource locations. This does not affect existing functions. (#10414)
• Added warning for cross-region event triggers (#10408)

v15.16.0

• Updated Firestore Emulator to v1.21.0, which adds support for subqueries and new stages like let(...), as well as allowing setting database-edition per-database.
• Suppressed the 'punycode' deprecation warning during firebase deploy on Node 22. (#10385)
• Fixed an issue where hosting deploy allowed publishing to a site in a different project. (#10376)
• Added SSE mode support to firebase mcp. To use it, run firebase mcp --mode=sse --port=3000, and connect your client on http://localhost:3000.
• Update the valid Python runtimes for functions. Default Python runtime is now Python 3.14.
• Fix CLI non-interactive mode for dataconnect init (#10401)
• Fixed issue where rules for non-default Firestore databases were not being deployed correctly.
• Suppress SSR warning for non-SSR Angular projects on init hosting (#10364)

... (truncated)

Commits

• 978a2ef 15.20.0
• 74f62c6 Add changelog entry for PR #10619 (#10622)
• 5aff739 fix: update dependencies in integration script packages to remediate vulnerab...
• 6b9723e Remove Data Connect service deletion logic on deploy (#10619)
• 07931cf fix: update dependencies in standalone bundler to remediate vulnerabilities (...
• 073a953 fix: use cross-spawn to avoid exec format errors when creating dataconnect ap...
• 7657d15 Update version of telemetry admin api (#10617)
• 1657829 fix: update dependencies in firebase-vscode to remediate vulnerabilities (#10...
• 7f54806 fix mistake in class initialization for ailogic (#10570)
• b665c53 Add --results-bucket update to CHANGELOG.md (#10604)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.