chore(deps): batch dependabot dependency updates

[CorieW]

Summary

Consolidates 25 open Dependabot PRs into a single batch update. All changes have been tested for TypeScript compilation. Downgrades introduced by PR #1019 have been identified and reverted (see notes below).

Dependabot PRs Included

PR	Description
#1093	bump protobufjs 7.5.4→7.6.1 in /firestore-vector-search/functions
#1092	bump protobufjs 7.5.3→7.6.1 in /storage-label-videos/functions
#1091	bump protobufjs 7.4.0→7.6.1 in /bigquery-firestore-export/functions
#1090	bump protobufjs 7.4.0→7.6.1 in /storage-transcode-videos/functions
#1089	bump protobufjs 7.4.0→7.6.1 in /firestore-multimodal-genai/functions
#1088	bump tmp 0.2.5→0.2.7 in /firestore-vector-search/functions
#1087	bump tmp 0.2.3→0.2.6 in /_emulator/functions
#1083	bump qs, body-parser, express in /firestore-genai-chatbot/functions
#1082	bump qs and express in /_emulator/functions
#1081	bump qs and lerna
#1079	bump @tootallnate/once 2.0.0→2.0.1 in /text-to-speech/functions
#1078	bump @tootallnate/once 2.0.0→2.0.1 in /firestore-vector-search/functions
#1077	bump @tootallnate/once and lerna
#1076	bump protobufjs and firebase-admin in /_emulator/functions
#1020	bump uuid 9.0.1→14.0.0
#1019	bump minor-and-patch group across 1 directory with 26 updates ⚠️ (partial — see notes)
#1012	bump uuid 9.0.1→14.0.0 in /text-to-speech/functions
#983	bump lodash 4.17.21→4.18.1
#982	bump lodash.template 4.5.0→4.18.1
#970	bump handlebars 4.7.7→4.7.9
#953	bump picomatch 2.3.1→2.3.2
#936	bump flatted 3.2.7→3.4.2
#926	bump tar and lerna
#896	bump minimatch 3.1.2→3.1.5

Changes Table

Direct dependency updates (package.json)

Package	Extension	Old	New
lerna	root	^4.0.0	^9.0.7
firebase-admin	_emulator/functions	^11.8.0	^13.10.0
@google/generative-ai	firestore-genai-chatbot	^0.1.1	^0.24.1
@google-cloud/vertexai	firestore-vector-search	^0.1.3	^0.5.0
sharp	firestore-multimodal-genai	^0.33.5	^0.34.5
@google-cloud/tasks	text-to-speech	4.0.0	4.1.0
@types/node	text-to-speech	14.18.34	14.18.63
uuid	text-to-speech	^9.0.0	^14.0.0

Transitive dependency updates (lock-file only)

Package	Old	New	Affected extensions
protobufjs	7.4.0–7.5.4	7.6.1	firestore-vector-search, storage-label-videos, bigquery-firestore-export, storage-transcode-videos, firestore-multimodal-genai, _emulator
tmp	0.2.3–0.2.5	0.2.6–0.2.7	firestore-vector-search, _emulator
@tootallnate/once	2.0.0	2.0.1	root, text-to-speech, firestore-vector-search
qs	various	latest	root, _emulator, firestore-genai-chatbot
body-parser	various	latest	firestore-genai-chatbot
express	various	latest	_emulator, firestore-genai-chatbot
lodash	4.17.21	4.18.1	root, multiple extensions
lodash.template	4.5.0	4.18.1	root
handlebars	4.7.7	4.7.9	root, multiple extensions
picomatch	2.3.1	2.3.2	root, multiple extensions
flatted	3.2.7	3.4.2	root, multiple extensions
tar	4.4.19	7.5.11	root (via lerna)
minimatch	3.1.2	3.1.5	root

⚠️ Downgrades from PR #1019 — Reverted

PR #1019 was a Dependabot group bump that included several version downgrades which broke TypeScript compilation. These have been reverted and are not included in this PR:

Package	Extension	PR #1019 change	Reason reverted
@google-cloud/vertexai	firestore-genai-chatbot	^1.1.0 → ^0.5.0	v0.5 uses snake_case API (generation_config); code targets v1.x camelCase API
@google-cloud/vertexai	firestore-multimodal-genai	^1.1.0 → ^0.5.0	Same
@google-ai/generativelanguage	firestore-multimodal-genai	^3.1.0 → ^2.9.1	Major version regression
@google-cloud/aiplatform	firestore-multimodal-genai	^4.1.0 → ^3.35.0	Major version regression
@google-cloud/aiplatform	firestore-semantic-search	^4.2.0 → ^3.35.0	Major version regression
@types/node	storage-label-images	^18.15.11 → ^14.18.63	Node 14 types missing PipelineSource required by @google-cloud/storage

Test plan

• All 13 extension functions build cleanly (tsc with zero errors) after npm install
• Deploy to dev-extensions-testing once Firebase Extensions service recovers from current backend incident affecting createSource LRO

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.