# Upgrade firebase-functions and firebase-admin

Yes. A Rush agent bumps firebase-functions and firebase-admin with pnpm, runs each sample's lint and tests, and opens one pull request with every bump.

[Run this on Rush](https://cloud.getrush.ai/run/upgrade-firebase-functions/firebase-functions/), in a Project that has your repository.

## What the agent does

In a repository like firebase/functions-samples, the Node/ directory is a pnpm workspace: Node/pnpm-workspace.yaml includes every package under it and sets minimumReleaseAge: 4320, so pnpm will not install a version published less than three days ago. The root package.json runs bootstrap-2nd-gen, lint-2nd-gen, compile-2nd-gen and test-2nd-gen through pnpm --recursive --filter "./Node/**". Each sample's functions/package.json asks for firebase-functions ^7.4.0 and firebase-admin ^14.5.0, and each has its own pnpm-lock.yaml beside it. The agent reads that layout first, because a bump has to land in every lockfile the workspace keeps.

The repository already has a weekly upgrade: .github/workflows/targeted-dependency-update.yml runs pnpm up -L -r firebase-functions firebase-admin and opens a pull request without running anything. The agent does the same bump with pnpm up -L -r firebase-functions firebase-admin inside Node/, respecting the three-day release age, and then runs the checks that workflow skips.

Those checks are the 2nd Gen CI ones from test_node.yml: npm run bootstrap-2nd-gen, npm run lint-2nd-gen, npm run compile-2nd-gen and npm run test-2nd-gen. Most samples have no test script; the ones that do are test-functions-jest, test-functions-jest-ts and test-functions-mocha, which run firebase-functions-test (^3.5.0) in offline mode and wrap a v2 function to check what it logs. For samples whose handlers use Firestore, Realtime Database or Auth triggers, the agent starts the Firebase emulators with firebase emulators:exec and runs the sample's tests against them where the sample provides a way to.

It also notes a mismatch it will not paper over: the functions' engines field says node 24, the root package.json says node 22, and CI tests on 22.x. The agent runs on the Node version CI uses and reports the difference instead of changing either one inside a dependency upgrade.

## Start it with one API call

`POST https://api.prix.dev/o/{org}/sessions`

```json
{
  "agent": "claude",
  "input": "In the Node/ directory only, upgrade firebase-functions and firebase-admin to the latest compatible versions with pnpm up -L -r, respecting minimumReleaseAge in pnpm-workspace.yaml, so every sample's package.json and pnpm-lock.yaml move together. Then run npm run bootstrap-2nd-gen, lint-2nd-gen, compile-2nd-gen and test-2nd-gen, and run the samples that use Firestore, Realtime Database or Auth triggers against the Firebase emulators with firebase emulators:exec where they have tests. Leave out any upgrade that breaks the build or tests and say why. Open a pull request with one line per bump and the samples whose tests ran.",
  "resources": [
    {
      "url": "https://github.com/your-org/your-app"
    }
  ]
}
```

1. **Get an API key.** In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
2. **Send the request.** POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
3. **Read what came back.** Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.

## What comes back

The pull request changes package.json and pnpm-lock.yaml in each Node/ sample, plus any sample code that a breaking firebase-functions or firebase-admin change required, each fix named in the description. The description lists the old and new versions, which of the four 2nd Gen scripts passed, which samples have tests and ran them, and any sample left on the old versions with the error that kept it there.

A reviewer compares the list of samples with tests to the list of samples changed: a bump in a sample with no test is proven only by lint and compile. The transcript at GET /o/{org}/sessions/{id}/messages has each pnpm and npm command's output, including the emulator log for samples that used it.

## Run it on every firebase-functions release

Start a run when firebase-functions or firebase-admin publishes a release, at least three days after it so minimumReleaseAge admits it, or on the same weekly schedule the existing workflow uses. Each start is one POST /o/{org}/sessions; a webhook on the key reports run.completed or run.failed.

Keeping the existing targeted-dependency-update.yml is fine; this run is the one that proves the bump, so the two pull requests can be compared side by side the first few weeks.

## Why run it on Rush?

A pnpm workspace with dozens of samples, each with its own lockfile, takes a while to install, lint, compile and test, and emulators add a Java dependency and open ports on whatever machine runs them. In Rush that happens in the run's own sandbox, and every command's output is kept for whoever reviews the pull request.

The difference from a blind version bump is evidence. A pull request that has already run lint, compile, tests and emulators on the new versions, and lists the samples where nothing could be tested, is one a maintainer can merge without rerunning the workspace first.

## Frequently asked questions

### Does it use pnpm or npm?

pnpm for the upgrade, because each sample keeps a pnpm-lock.yaml and the workspace is defined in pnpm-workspace.yaml. The root scripts are run with npm run, as the repository's CI does, and they call pnpm underneath.

### Will it upgrade to a version released yesterday?

No. minimumReleaseAge: 4320 in pnpm-workspace.yaml makes pnpm refuse versions younger than three days, and the agent keeps that setting.

### Does it need my Firebase project?

No. firebase-functions-test runs offline and the emulators run locally in the sandbox. Nothing is deployed, so no project credentials are needed.

### Will it change the 1st gen samples?

No. The request names the Node/ directory only, so Node-1st-gen, Python and Dart stay as they are.