fix: update example to work with CodeSandbox and other cloud sandboxes

[tyler-reitz]

Summary

• Replace local tarball reference (file:../reactfire-4.0.1.tgz) with reactfire: latest from npm so cloud sandboxes can install dependencies
• Update React, React DOM, and related devDependencies to React 18
• Add .codesandbox/tasks.json to auto-start the Vite dev server
• Set server.allowedHosts: true in vite.config.js for Vite 5 compatibility with CodeSandbox's forwarded preview URLs

This makes the following URL work out of the box for anyone clicking through from the README:
https://codesandbox.io/s/github/FirebaseExtended/reactfire/tree/main/example

Note: firebase stays at ^9.0.0 to match the peer dependency constraint of the currently published reactfire@4.2.3. This can be bumped when the next major version ships.

Test plan

• Verified the CodeSandbox URL loads, installs deps cleanly, starts Vite, and renders the kitchen sink app (Authentication, Firestore, Functions sections all visible)

[gemini-code-assist]

Code Review

This pull request adds CodeSandbox task configurations, upgrades React and React-DOM to version 18, updates other dependencies (including Vite and TypeScript), and configures Vite's development server. Feedback on these changes includes: restricting allowedHosts in vite.config.js to specific sandbox domains to prevent DNS rebinding attacks; pinning the reactfire dependency instead of using 'latest' to ensure deterministic builds; updating the React entry point to use createRoot to properly support React 18; and bumping the minimum Vite version to ^5.4.12 to ensure the allowedHosts option is supported.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Setting allowedHosts: true disables host validation entirely, which exposes the local development server to DNS rebinding attacks (as warned in Vite's documentation). Since this example is intended for cloud sandboxes like CodeSandbox and StackBlitz, you can restrict the allowed hosts to only these platforms using subdomain wildcards (by prefixing with a dot "."). This maintains compatibility while keeping the dev server secure.

Suggested change

	allowedHosts: true,
	allowedHosts: ['.csb.app', '.codesandbox.io', '.stackblitz.io', '.webcontainer.io'],

[gemini-code-assist]

Using "latest" for a dependency is discouraged because it makes builds non-deterministic and can break the example in the future if a new major version of reactfire is released with breaking changes. It is highly recommended to pin this to a specific version or a safe semver range (e.g., "^4.2.3" which is the current stable version).

Suggested change

	"reactfire": "latest",
	"reactfire": "^4.2.3",

[gemini-code-assist]

Upgrading react and react-dom to "^18.0.0" is great, but the entry point (example/index.tsx) still uses the deprecated ReactDOM.render API. This will cause React 18 to run in React 17 backward-compatibility mode and log a deprecation warning in the console. To fully leverage React 18, the entry point should be updated to use createRoot from react-dom/client.

[gemini-code-assist]

The server.allowedHosts configuration option was introduced in Vite 5.4.12 (as a backport for the security fix) and Vite 6.0.9. Since you are specifying "vite": "^5.0.0", npm could resolve this to an older version of Vite 5 (e.g., 5.0.0 to 5.4.11) which does not support this option or include the security fix. To ensure the option is recognized and the security fix is active, please bump the minimum Vite version to "^5.4.12".

Suggested change

	"vite": "^5.0.0"
	"vite": "^5.4.12"