Override vulnerable grpc-js and uuid in rules tests

[SamiPr0]

Problem

Three Dependabot alerts stayed open, and Dependabot's own update jobs failed on them ("the available update path still resolves it to 9.0.1"):

Alert	Package	Why Dependabot can't fix it
#8 high, #7 low	@grpc/grpc-js 1.9.16, fixed in 1.13.6	@firebase/firestore pins ~1.9.0
#1 medium	uuid 9.0.1, fixed in 11.1.1	gaxios pins ^9.0.1

This only affects the Firestore rules test tooling in firebase/firestore/test. None of it ships in the app.

Change

overrides in firebase/firestore/test/package.json:

• @grpc/grpc-js: ^1.13.6, now 1.14.5 everywhere;
• gaxios → uuid: ^11.1.1. Scoped to gaxios because universal-analytics already uses uuid 14 and a global override would break it.

Verification

• npm ls: no invalid packages.
• npm audit: 16 → 9 findings, with grpc-js and uuid gone. The 9 left were already on main and are all inside firebase-tools, the Firebase CLI: basic-ftp, @opentelemetry/core, braces (which has no fix yet). GitHub doesn't flag them, and they need a firebase-tools release.
• All 32 rules tests pass on the Firestore emulator with the new versions. They talk to the emulator through grpc-js, so the override is exercised for real.

🤖 Generated with Claude Code