The firestore-bigquery-export extension has 4 remaining low dependency vulnerabilities.
These are transitive dependencies; they're dependencies of the change tracker package.
The change tracker is actually on a newer major version right now (2.x)
A minimal fix for this issue is to publish a patch somehow on 1.x (not sure if the CI supports this) with npm audit fix changes.
What we might have to do is create a branch with a downgraded version of the package and point the CI there.