Firebase

The Firebase MCP server now refers to firebase_update_environment instead of update_firebase_environment, and CVE-2026-111181 is fixed via a body-parser dependency update. The Firestore emulator now logs a warning instead of exiting when it cannot watch the rules file, and chokidar moved to ^4.0.3 to drop the vulnerable braces dependency.

A security fix has been deployed to some of the helper code used by Authentication. Most users need take no action, but anyone rehosting the helper code should re-synchronize it to the latest version.

Fixed an issue with the Cloud Firestore emulator watching rules files and fixed the Firebase MCP server environment command. Also updates the Firebase SQL Connect local toolkit to v3.4.25, plus dependency and security updates.

Projects can now temporarily delay the automatic enforcement of Firebase App Check for Firebase AI Logic. Auto-enforcement for projects that haven't already enabled it begins November 2, 2026, and apps without App Check implemented can use the delay to ship versions that include it.

Test Lab devices ipad10/16.6, iphone11pro/16.6, iphone14pro/16.6, and iphone8/16.6 are deprecated and will be removed on 2026-11-23. Users on these devices should move to a different device now.

C++ SDK v14.1.0 and v13.13.1 and Unity SDK v14.1.0 and v13.17.1 both carry a Firestore security update, alongside an Auth fix in the C++ SDK and AI Logic changes plus bug fixes in the Unity SDK. Flutter SDK v5.1.0 brings Firestore, AI Logic, Core, and SQL Connect changes with bug fixes.

Firebase Functions no longer accepts empty inputs for Secret param values, and 2nd Gen Auth Emulator CloudEvent payloads now conform to the Eventarc google.events.firebase.auth.v2.AuthEventData wire format. The MCP server now suggests the installed firebase CLI rather than always npx firebase-tools@latest, and the Hosting API is enabled before deploying.

The Firebase CLI now ensures the Firebase Hosting API is enabled before running commands, and the Firebase SQL Connect local toolkit is updated to v3.4.24. The release also includes several fixes and improvements.

Data modification language operations in Cloud Firestore are generally available, adding support for insert and upsert stages.

Firebase Apple SDK version 12.19.3 is available for installation; the announcement provides no details on what changed.

The Firebase Apple SDK v13.1.1 is now available; release details and installation instructions are linked from the Firebase iOS release notes.

Authentication adds strengthened OAuth and reCAPTCHA session identifiers, bounded backend token lifetimes, and fixes a crash on malformed multi-factor responses plus concurrency issues in AuthAPNSTokenManager. Realtime Database fixes several crashes (get errors without reason, purging writes with pending acks, invalid server hosts), and a Gemini Live API voice activity feature lands in AI Logic.

Firestore Pipelines now support delete, update, insert, and upsert DML stages, a literals source stage, and an atomic option on PipelineExecuteOptions for single-transaction pipeline execution. Auth no longer clears the persisted user during initialization unless the reload fails with auth/user-token-expired or auth/user-disabled, preserving sessions across transient 5xx UNAVAILABLE errors.

Apple SDK and JavaScript SDK both reach v13.1.0, while Android BoM moves to v35.1.0 with updates to AI Logic, Firestore, Cloud Messaging, Crashlytics, Crashlytics NDK, and Remote Config. The notes do not describe specific changes in any of these SDK updates.

The Firebase Apple SDK (v13.1.0) is now available. For more details, see the Firebase Apple SDK release notes. To install this SDK, see Add Firebase to your app.

Text search and geospatial search are generally available for Firestore with MongoDB compatibility and for Cloud Firestore Enterprise edition.

Fixed an issue where throttled task queues stopped processing remaining tasks when a task exhausted its retries or timed out, and a race condition in SourceTokenScraper that could hang concurrent function deployments. Added crashlytics:heapdumps:{enable,disable,status} commands for managing Crashlytics Android heap dump collection, plus fixes for hosting:clone source site resolution, analytics timeouts masking command errors, and unhandled exceptions during Cloud Functions deployment exiting with code 0.

Adds commands to manage Crashlytics Android heap dump collection, updates Firebase Authentication deployment to use existing apps from any platform, and includes fixes and improvements.