chore: prune fcm-tester deps to fix alerts

[jvsena42]

This PR:

1. Replaces googleapis with google-auth-library in the FCM tester tool, clearing every open Dependabot alert
2. Adds a dependabot.yml for the three ecosystems this repo has — the tools/fcm-tester npm tree, workflow actions, and the Gradle catalog

Description

All three open alerts, and both dismissed ones, came from tools/fcm-tester/package-lock.json. Nothing vulnerable reaches the app: the scope is development and there are no Gradle findings.

They were collateral from an over-broad dependency. The tool declared googleapis, a meta-SDK for every Google API, but uses one thing from it — google.auth.JWT — which lives in google-auth-library and is only re-exported. qs and one uuid came solely through googleapis-common; the second uuid came from the older gaxios that google-auth-library 9 depended on. Depending on the auth library directly resolves all of them with no pins, overrides or dismissals, and the regenerated lockfile also picks up the patched jws, clearing the dismissed high-severity alert. The tree goes from 42 packages to 23.

google-auth-library 11 requires Node 22, so .nvmrc moves off v20.15.1, end of life since April 2026. That forces a fix already overdue: the entry point imported the service account JSON with assert { type: "json" }, syntax removed in Node 22, so the tool would not start on any current runtime. The JWT constructor also became options-only, so the positional call was rewritten; authorize still accepts a callback, so the promise wrapper is unchanged.

Dependabot config

The repo has had alerts enabled for a long time but never a Dependabot pull request, because there was no config file. Hand-fixing advisories, as the first half of this PR does, is the work this is meant to stop from recurring.

Grouping is cost control: ci.yml and lint.yml run on every PR with no path filter, and e2e.yml fires on gradle/**, *.gradle.kts or its own workflow file. Ungrouped, six updates in a month is six full CI runs. npm and Gradle group minor and patch only, so majors fall through to their own PR. Actions need a second group because every one is pinned to a floating major tag, so a minor/patch group would never fire and each action would arrive separately.

Two sets of Gradle coordinates are ignored. The com.synonym:* artifacts resolve from credentialed GitHub Packages registries Dependabot cannot read, and move in lockstep with native code. The Kotlin toolchain — Kotlin, AGP, KSP, Compose compiler, stability analyzer, Compose BOM — is a compatibility matrix that took #1121 and #1127 to move deliberately; Dependabot resolves each coordinate independently with no view of it, so grouping would not help and only ignoring keeps it out. Everything else in the catalog updates normally. The rules use org.jetbrains.kotlin:* rather than a looser prefix so org.jetbrains.kotlinx packages keep updating.

Admin steps to finish enabling this

A config file only turns on version updates. Turning an advisory into a pull request is a separate repo setting. Merging this alone will not make alerts arrive as pull requests. Either tick Settings → Advanced Security → Dependabot security updates, or run the equivalent from the CLI. Both need admin and return 204 No Content:

# already on here, but idempotent and safe to re-run
gh api --method PUT repos/synonymdev/bitkit-android/vulnerability-alerts

# this is the one that turns an alert into a pull request
gh api --method PUT repos/synonymdev/bitkit-android/automated-security-fixes

Verify afterwards:

# expect {"enabled": true, "paused": false}
gh api repos/synonymdev/bitkit-android/automated-security-fixes

# expect HTTP/2.0 204 — a 404 means either disabled or the caller is not an admin
gh api repos/synonymdev/bitkit-android/vulnerability-alerts --include | head -1

Both return 404 for this PR's author, who has maintain and not admin, so the current state cannot be read from here and someone with admin has to run them. Alerts themselves are on — this PR exists because of three.

Preview

N/A — developer tooling and repository configuration only.

QA Notes

Manual Tests

Dependabot reads dependabot.yml from the default branch only, so tests 3 onward cannot run until this merges. Each row in the Dependabot tab has a Check for updates button that forces a run.

• 1. With tools/fcm-tester/service-account.json present → nvm use && npm i → npm start: prints the access token banner followed by a ya29.… token.
• 2. regression: Paste that token into the Postman collection as bearerToken → send messages/notification.json to a device token: notification arrives and logcat shows the FCM tag entry.
• 3. Insights → Dependency graph → Dependabot: three rows listed (npm, GitHub Actions, Gradle), each with a Last checked timestamp and no config error banner.
• 4a. Dependabot tab → Gradle row → Check for updates → job log: androidx, Ktor, Room, Hilt and detekt resolve from gradle/libs.versions.toml.
  • 4b. Same log: com.synonym:* and the Kotlin/AGP/KSP/Compose matrix are skipped as ignored, and org.jetbrains.kotlinx packages stay eligible.
• 5. Dependabot tab → npm row → Check for updates: resolves tools/fcm-tester/package-lock.json and does not look at the repo root.
• 6. Dependabot tab → GitHub Actions row → Check for updates: one grouped github-actions-major PR rather than one per action; github-actions-minor produces nothing.
• 7. Repo admin → run the two gh api --method PUT commands above → automated-security-fixes returns enabled: true, paused: false.
• 8. First grouped PR Dependabot opens → CI and Lint: both green. Dependabot PRs run with a read-only token and no secrets, so a failure on secret ownership rather than on the bump needs a Dependabot secret or an author guard in a follow-up.

Automated Checks

• No Kotlin or Gradle build code changed, so no test coverage was added, modified or removed.
• npm audit reports 0 vulnerabilities on the regenerated lockfile, down from three open advisories, and npm ls qs uuid googleapis googleapis-common returns empty for all four.
• node index.js token now fails only on the gitignored service-account.json, exercising the changed import, the JSON import attribute and the JWT construction.
• npx -y js-yaml .github/dependabot.yml parses cleanly with the intended ecosystems, groups and ignore rules. Schema validity is otherwise enforced by GitHub, which annotates an invalid config on the PR.
• Grouping and resolution behaviour can only be observed once the config is on the default branch (after merge); the manual steps cover that.
• CI: standard checks run by the PR bot.

Linked Issues/Tasks

• Sibling precedent: chore: add dependabot config for automated PRs bitkit-ios#655, the equivalent config for the iOS repo
• Toolchain matrix context for the Gradle ignore rules: chore: update kotlin and compose bom #1121 and chore: upgrade to agp 9 and configure parallelism #1127

[greptile-apps]

Greptile Summary

Replaces the FCM tester’s broad googleapis development dependency with google-auth-library, updates its authentication initialization and Node runtime, and regenerates the smaller lockfile.

• Migrates service-account authentication to the JWT options constructor and Node’s current JSON import-attribute syntax.
• Pins the local development runtime to Node 22.23.2.
• Adds monthly npm Dependabot updates for tools/fcm-tester.
• Removes transitive packages previously pulled in by the Google APIs meta-SDK.

Confidence Score: 5/5

The PR appears safe to merge, with the FCM tester’s runtime, authentication API, and dependency metadata updated consistently.

The selected Node version satisfies the new dependency’s engine requirement, the JWT migration preserves the token-generation flow, and no concrete blocking or non-blocking defect remains.

Important Files Changed

Filename	Overview
tools/fcm-tester/index.js	Migrates the JSON import and JWT initialization to APIs compatible with Node 22 and google-auth-library 11 without changing the surrounding token flow.
tools/fcm-tester/package.json	Replaces the broad googleapis development dependency with the narrower authentication library.
tools/fcm-tester/package-lock.json	Regenerates the dependency tree around google-auth-library 11.0.0 and removes the unnecessary Google APIs transitives.
tools/fcm-tester/.nvmrc	Selects a Node 22 runtime satisfying the new authentication library’s engine requirement.
.github/dependabot.yml	Enables monthly npm dependency-update pull requests specifically for the FCM tester.

_{Reviews (1): Last reviewed commit: "chore: add dependabot config to warnings..." | Re-trigger Greptile}

[jvsena42]

@ovitrif I don't even remember using this tool, do you think we should keep it?

[ovitrif]

Approved: the fcm-tester google-auth-library migration and Dependabot config are consistent and ready to merge.