chore(deps): migrate monorepo to Lerna v9 and npm workspaces

[inlined]

Security Audit & Remediation: extensions

A. Previous CVEs

• GHSA-f5x3-32g6-xq36 - tar (Severity: High)
• GHSA-mh29-5h37-fv8m - js-yaml (Severity: Moderate)
• GHSA-72xf-g2v4-qvf3 - tough-cookie (Severity: Moderate)
• GHSA-p6mc-m468-83gw - lodash (Severity: High)

B. Changes Made

• Added dependency overrides in the root package.json to force secure versions of transitive dependencies:
  • tar: ^7.5.19
  • js-yaml: ^4.1.2
  • tough-cookie: ^4.1.3
  • lodash: ^4.17.21
• Rebuilt lockfiles.

C. Remaining CVEs

• 67 remaining vulnerabilities (7 low, 28 moderate, 27 high, 5 critical) inside sub-packages (these are audited separately).

D. Introduced CVEs

• None.

E. Testing Strategy

• Verified local installation and Lerna v3 bootstrapping runs successfully.
• Ran npm run lint successfully.

[gemini-code-assist]

Code Review

This pull request migrates the repository to npm workspaces, updates Lerna to version 9.0.7, and configures skipLibCheck in several TypeScript configurations. Feedback on these changes highlights two critical issues: first, the auth-mailchimp-sync/functions package was accidentally omitted from the new workspaces array in package.json; second, the generate-package-locks script needs to be updated with --workspaces=false to prevent npm from updating the root lockfile instead of generating individual workspace lockfiles.

[gemini-code-assist]

The package "auth-mailchimp-sync/functions" was present in the previous lerna.json packages list but has been omitted from the new workspaces array in package.json. This will prevent npm workspaces and Lerna from managing, building, or testing this package.

Please add "auth-mailchimp-sync/functions" back to the workspaces list.

Suggested change

	"firestore-shorten-urls-bitly/functions",
	"firestore-send-email/functions",
	"firestore-shorten-urls-bitly/functions",
	"auth-mailchimp-sync/functions",
	"firestore-send-email/functions",

[gemini-code-assist]

With the migration to npm workspaces, running npm i --package-lock-only inside a workspace package directory will traverse up to the root and update the root package-lock.json instead of generating a local package-lock.json inside each package. This will prevent the generate-package-locks script from generating the individual lockfiles required for Firebase Extensions packaging and deployment.

To fix this, the generate-package-locks script (on line 32) needs to be updated to disable workspaces during the lockfile generation:

"generate-package-locks": "lerna exec -- npm i --package-lock-only --workspaces=false"