chore(deps-dev): bump firebase-tools from 15.22.4 to 15.28.2

[dependabot]

Bumps firebase-tools from 15.22.4 to 15.28.2.

Release notes

Sourced from firebase-tools's releases.

v15.28.2

• [Fixed] Defer secret access permission granting to release phase to prevent service account 404 race conditions.
• Fixed parsing and path resolution bugs in ext:export options, and reverted --extension-instance option back to --instance.
• [Fixed] Increases default polling timeout for App Hosting operations and rollouts to 60 minutes.
• Fixed an issue where App Hosting deploys failed when the deploying account lacked permission to create or grant roles to the default compute service account, even when that service account already existed. (#10806)

v15.28.1

• Fixed an issue where Dart functions incorrectly required Dart 3.13.0 or later.

v15.28.0

• Fixed an issue where the deploy MCP tool failed with authentication errors during Data Connect deployment.
• Refined the `login` MCP tool description and security verification instructions to enforce Session ID output for agents and prevent phishing attacks (#10942).
• Added `reauth` option to `login` MCP tool and aligned behavior to skip login and display account email if already authenticated.
• Updated Pub/Sub emulator to version 0.8.35.
• Added extensions replacement registry and scraper tool to track migrations for deprecated extensions ahead of the March 2027 decommission date.
• Load existing .env files and passes environment variables to functions discovery in runtimeDelegate.
• Adds --immediate flag to ext:uninstall (#10921)
• Updated dataconnect emulator version to v3.4.18.
• Fixed a bug where deploying Dart functions with dependencies that use native build hooks (e.g. sqlite3) failed to compile. Note: Dart functions now require Dart SDK 3.13.0 or later.

v15.27.0

• Fixed an issue where managed service accounts for declarative security were not deleted when all functions in a codebase were deleted, or caused IAM permission errors on empty codebase deploys.
• Configured OneMCP server tools to require a Firebase project by default, with options to opt-out specific tools (such as Developer Knowledge document search).
• Fixed a bug where deploying functions with the dartfunctions experiment enabled could incorrectly prompt to delete existing GCF v2 functions.
• Added outputSchema support for local MCP tools.
• Skip functions lifecycle hooks during partial (filtered) deployments, and print instructions for running them manually.
• Added appcheck:providers:list, appcheck:providers:get and appcheck:providers:set to configure App Check attestation providers for an app.
• Added appcheck:apps:list to show every app with its configured App Check providers.
• Added web app support for Crashlytics MCP tools and prompts.
• Added support for forwarding custom HTTP headers (Mcp-Param-*) to remote MCP tools when defined in tool parameter input schemas (x-mcp-header), per SEP-2243.
• Improved function parameter prompting clarity for multi-codebase deploys (#10897)

v15.26.0

• Automatically enable non-interactive mode when an AI agent is detected in the environment to prevent the CLI from hanging on interactive prompts.
• Added support for a two-phase non-interactive login flow. Initiate this by running firebase login --non-interactive, navigate to the printed link to get an authorization code, and complete the login by running firebase login <auth_code>.
• Fixed apps:init writing google-services.json to an app/app path when the Android module has no src directory, by detecting the module from the directory basename instead of the first path segment (#10863).
• Fixed firestore:locations failing with a null project error when run without an active project (#10881).
• Fixed authentication refresh issue under Application Default Credentials (ADC) when no project is active (#10880).
• Added crashlytics:onboard:web CLI command to support Crashlytics onboarding for web apps.
• Added hidden source map support to crashlytics:sourcemap:upload.
• Fixed typo in loginPrototyper URL which caused issues during Firebase MCP server firebase_login
• Added appcheck:services:list, appcheck:services:get and appcheck:services:set to read and change App Check enforcement per service.
• Fixed unenforced read-only isolation for Native SQL queries for Firebase SQL Connect.

Firebase CLI v15.26.0-sea.preview.5 (Functions Emulator Fix)

Release preview.5 resolving issue #10984:

• Resolved extensionless JavaScript script execution in SEA child process resolver
• Fixed Functions Emulator worker initialization for functionsEmulatorRuntime

Firebase CLI v15.26.0-sea.preview.4 (Shell & Script Execution Fixes)

... (truncated)

Commits

• ec32692 15.28.2
• 2d3aa69 feat(functions): Support local directory function kits (#10988)
• 1745520 Add functions:kits:uninstall command (#10981)
• 1872bb8 Adding Replacment Kits column in ext:list (#10986)
• de22a14 fix: improve kit deploy report (#10987)
• c5e739b fix(functions): defer secret access granting to release phase to prevent SA 4...
• f8db4bc fix: update typo for 1p kits to firebase-function-kits (#10985)
• fe4d632 refactor(functions): Create kits install API and include env seeding support ...
• 5c167cb fix(extensions): revert ext:export option name change and fix parsing bugs (#...
• 9b5ebba Initial commit for ext:migrate (#10974)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)