---
scope: org
organization: firebase
release_count: 9
last_release: 2026-10-07
generated: 2026-05-04
updated: 2026-10-16
canonical: https://releases.sh/firebase/overview.md
---

Shipped a major JavaScript SDK release with breaking AI API changes, a Zip-and-Carthage Apple SDK patch, and CLI hosting and function-kit updates.

**The JavaScript SDK's AI package reworked its template APIs.**
- `TemplateGenerativeModel.generateContent` and `generateContentStream` now take a single `TemplateRequest` object (`templateId`, `templateVariables`, `toolConfig`), and `templateVariables` is required in both `TemplateRequest` and `StartTemplateChatParams`.
- Previously deprecated `VertexAIBackend` and `BackendType.VERTEX_AI` are removed.

**Apple SDK 13.0.0 splits by install method.** 13.0.0 is Swift Package Manager only; Zip and Carthage users need 13.0.1, which carries the same Analytics hardening. Gemini 3.x tuning parameters are deprecated, the ML model downloader library is gone, and the minimum C++ standard moved from C++14 to C++17.

**CLI gained function kits, extension migration, and simpler Hosting setup.**
- `functions:kits:install`, `uninstall`, and `list` configure and run multiple instances of functions; `ext:migrate` is new, and `ext:export` and `ext:list` were updated to match.
- Functions `.env` files can override a named secret's ID and version via `FIREBASE_SECRET_REF_<SECRET_NAME>`.
- Hosting API requests are project-scoped rather than site-scoped, and `apps:create web` and `auth` initialization now offer to create a default Hosting site.
- `crashlytics:heapdumps:{enable,disable,status}` manages Android heap dump collection. Pre-existing Crashlytics source maps can be overwritten, Angular builds strip leading paths like `/dist/angular/browser/`, and re-uploads across app versions no longer 404.

**Deploy and emulator friction eased.** A killed deploy no longer leaves the Python discovery admin server running and hanging later deploys, and 2nd Gen Auth triggers (`onUserCreated`, `onUserDeleted`) work in the local Functions and Auth emulators. Throttled task queues keep processing after a task exhausts retries, and RFC-invalid function parameter expressions now load correctly. Dependency updates addressed vulnerabilities in `protobufjs`, `tar`, `@grpc/grpc-js`, `express`, and others.