chore(deps): bump firebase-tools from 15.19.0 to 15.27.0

[dependabot]

Bumps firebase-tools from 15.19.0 to 15.27.0.

Release notes

Sourced from firebase-tools's releases.

v15.27.0

• Fixed an issue where managed service accounts for declarative security were not deleted when all functions in a codebase were deleted, or caused IAM permission errors on empty codebase deploys.
• Configured OneMCP server tools to require a Firebase project by default, with options to opt-out specific tools (such as Developer Knowledge document search).
• Fixed a bug where deploying functions with the dartfunctions experiment enabled could incorrectly prompt to delete existing GCF v2 functions.
• Added outputSchema support for local MCP tools.
• Skip functions lifecycle hooks during partial (filtered) deployments, and print instructions for running them manually.
• Added appcheck:providers:list, appcheck:providers:get and appcheck:providers:set to configure App Check attestation providers for an app.
• Added appcheck:apps:list to show every app with its configured App Check providers.
• Added web app support for Crashlytics MCP tools and prompts.
• Added support for forwarding custom HTTP headers (Mcp-Param-*) to remote MCP tools when defined in tool parameter input schemas (x-mcp-header), per SEP-2243.
• Improved function parameter prompting clarity for multi-codebase deploys (#10897)

v15.26.0

• Automatically enable non-interactive mode when an AI agent is detected in the environment to prevent the CLI from hanging on interactive prompts.
• Added support for a two-phase non-interactive login flow. Initiate this by running firebase login --non-interactive, navigate to the printed link to get an authorization code, and complete the login by running firebase login <auth_code>.
• Fixed apps:init writing google-services.json to an app/app path when the Android module has no src directory, by detecting the module from the directory basename instead of the first path segment (#10863).
• Fixed firestore:locations failing with a null project error when run without an active project (#10881).
• Fixed authentication refresh issue under Application Default Credentials (ADC) when no project is active (#10880).
• Added crashlytics:onboard:web CLI command to support Crashlytics onboarding for web apps.
• Added hidden source map support to crashlytics:sourcemap:upload.
• Fixed typo in loginPrototyper URL which caused issues during Firebase MCP server firebase_login
• Added appcheck:services:list, appcheck:services:get and appcheck:services:set to read and change App Check enforcement per service.
• Fixed unenforced read-only isolation for Native SQL queries for Firebase SQL Connect.

Firebase CLI v15.26.0-sea.preview.4 (Shell & Script Execution Fixes)

Release preview.4 addressing shell wrapper option parsing and npm lifecycle scripts:

• Fixed runtime/shell argument parsing for npm's '-c --' invocations (fixing protobufjs postinstall and predeploy lint/build)
• Redirected runtime/node wrapper directly to 'is:node' for robust node eval (-e), version (-v), and script execution
• Preserved PATH environment across child subshells

Firebase CLI v15.26.0-sea.preview.3 (Bug Bash Fixes)

Release preview.3 addressing all bug bash findings:

• Fixed CWD binary name collision in SEA child script resolver
• Bundled missing TypeScript and project init templates
• Added #!/bin/sh shebang to runtime wrapper binaries (fixing exec format error in predeploy)
• Improved WebSocket transport shutdown in logging emulator

Firebase CLI v15.26.0-sea.preview.2 (Pre-Signed SEA Preview)

Experimental standalone binaries with automated Mach-O ad-hoc code signing and true Universal 2 binaries.

Firebase CLI v15.26.0-sea.preview.1 (Node 26 SEA Preview)

Experimental standalone binaries for firebase-tools built using Node 26 Single Executable Applications (SEAs).

v15.25.1

• Fix typo that was breaking the emulator handling of secret params (issue #10866)
• Fixes service account propagation delays during Cloud Functions deploys and cleans up newly created service accounts on 100% deployment failure (#10871).
• Fixed appcheck:debugtokens:list and appcheck:debugtokens:delete prompting "Select the app to register a debug token for" when asking which app to operate on.

v15.25.0

• Update Firestore emulator to v1.22.0, adding support for DML

... (truncated)

Commits

• fb863e1 15.27.0
• d102ccf fix(functions): cleanup declarative security service account when codebase fu...
• 91745b0 fix: inherit parent process env in Python discovery subprocess (#10818)
• c50833e feat: default OneMCP servers to require project, add project requirement opt-...
• b02243c feat(functions): Add kit migration template and support both net new install ...
• 7036e4c refactor(kits): rename sourcePackage id to name (#10922)
• c66f9dd fix: prevent gen1 node functions from deploying in kits (#10919)
• 6e01c92 feat: inject FIREBASE_KIT_INSTANCE_ID environment variable for function kits ...
• fbd384e fix(functions): skip lifecycle hooks on partial (filtered) deployments (#10909)
• 549aa7a experimental ext:export support for exporting to functions .env format (#10895)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud