@google-cloud/firestore

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication transparency weaker than it could be despite the package's otherwise strong project evidence.

Lifecycle scriptscaution

A prepare script runs during installation, which adds build-time behavior compared with a purely passive artifact, but this is not severe in the context of a maintained client library.

Workflow auditcaution

All 69 analyzed action references are pinned and there are no high- or medium-severity findings. Two high-confidence low-severity adhoc-package findings remain, and one of 19 workflows failed analysis; the pull_request_target workflow has broad write permissions but no reported untrusted checkout or script-injection sink.