npx @buildinternet/releases get firebase-toolsWhen declarative security APIs (IAM and Cloud Resource Manager) are disabled on a project, the CLI now fails fast with an actionable error and remediation instructions. Also fixes cleaning up managed service accounts when opting out of declarative security alongside a filtered codebase deploy, warns in ext:uninstall --immediate about secrets bound to an extension that will be deleted, and generates deterministic unsalted ETags for declarative security roles.
The local dataconnect_execute tool is now dataconnect_execute_in_emulator for running GraphQL queries and mutations against the SQL Connect emulator. Also fixes retries for IAM policy updates, Cloud Functions creation, and deployment deadlocks, plus managed service account cleanup when functions are deleted.
Added a -f, --force option to firebase ext:migrate, plus a humanReadableDescription field for MCP tools. Fixed the Functions emulator masking IPC failures with a misleading TypeError, and improved parameter type preservation during extension updates.
Deferred secret access permission granting to the release phase to prevent service account 404 race conditions. App Hosting deploys no longer fail when the deploying account lacks role-granting permissions on an existing default compute service account, and the default polling timeout for App Hosting operations rose to 60 minutes. Also reverted the --extension-instance option back to --instance and fixed ext:export parsing and path resolution.
Resolved extensionless JavaScript script execution in the SEA child process resolver and fixed Functions Emulator worker initialization for functionsEmulatorRuntime.
Fixed an issue where Dart functions incorrectly required Dart 3.13.0 or later, relaxing the version constraint.
Fixed the deploy MCP tool failing with authentication errors during Data Connect deployment, and added a reauth option to the login MCP tool that skips login when already authenticated. Added an ext:uninstall --immediate flag and a registry for tracking deprecated extensions ahead of the March 2027 decommission. Note: Dart function deployments now require Dart SDK 3.13.0 or later.
Fixed runtime/shell argument parsing for npm's '-c --' invocations, which was breaking protobufjs postinstall and predeploy lint/build scripts. The runtime/node wrapper now points directly to 'is:node', and PATH is preserved across child subshells.
Bug-bash preview release fixes an exec format error in predeploy by adding a #!/bin/sh shebang to runtime wrapper binaries, resolves a CWD binary name collision in the SEA child script resolver, bundles missing TypeScript and project init templates, and improves WebSocket shutdown in the logging emulator.
Managed service accounts for declarative security are now deleted when a codebase's functions are removed, and empty codebase deploys no longer hit IAM permission errors. Added appcheck:providers:list/get/set commands, appcheck:apps:list, outputSchema support for local MCP tools, and web app support for Crashlytics MCP tools, plus custom HTTP header forwarding to remote MCP tools.
Experimental standalone binaries now support automated Mach-O ad-hoc code signing and true Universal 2 binaries.
Experimental standalone binaries for firebase-tools are now built using Node 26 Single Executable Applications (SEAs).
The CLI now automatically enables non-interactive mode when an AI agent is detected, preventing hangs on interactive prompts, and supports a two-phase non-interactive login via firebase login --non-interactive followed by an auth code. Also added Crashlytics web onboarding, appcheck:services commands for per-service enforcement, and fixed several project-detection bugs.
Fixed a typo breaking the emulator's handling of secret params, and resolved service account propagation delays during Cloud Functions deploys. Also fixed appcheck:debugtokens:list and appcheck:debugtokens:delete prompting for a debug token registration when selecting an app to operate on.
Added CLI commands for managing App Check debug tokens and fixed the Storage Emulator hanging on JSON uploads larger than 100KB. Also fixed a Data Connect emulator crash on cancelled GraphQL requests and a Cloud Storage emulator hang under concurrent requests.
Declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions, plus new functions:lifecycle:list and functions:lifecycle:run commands. Fixed a Hosting emulator timeout when a web frameworks request with a body falls through to a function rewrite, and removed the Dart warning.
Declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions, plus new functions:lifecycle:list and functions:lifecycle:run commands to view and run lifecycle hooks in isolation. Fixed an issue in apps:create where the App Store ID prompt was always shown.
Fixes auth:export and auth:import dropping mfaInfo data for users with Multi-Factor Authentication enabled. Updated Pub/Sub emulator to v0.8.34.
Disables keep-alive in google-auth-library calls to prevent Premature close errors on certain Node versions.
Upgraded zod to v4, replacing the deprecated zod-to-json-schema dependency with zod v4's built-in z.toJSONSchema(). Fixed an intermittent "Premature close" error during login and API requests, and switched cloudbilling API calls to user project quota to avoid shared quota exhaustion.
