What invertase/react-native-firebase shipped
Generated by FoxPlug from public activity — not affiliated with Rnfirebase.
Week of September 14, 2026
What shipped
- Fixed prototype pollution vulnerability in deepSet by rejecting unsafe path segments like __proto__, prototype, and constructor. Pull request #9295
- Fixed code injection vulnerability in ios_config.sh where firebase.json values could break out of Ruby/Python string literals during Xcode builds. Pull request #9294
- Bumped Firebase SDKs to 34.19.0 (Android), 12.19.0 (iOS), and 12.19.0 (JS) across all platforms. Pull request #9317
- Removed sensitive authentication data from debug logs including verification IDs, phone numbers, and auth secrets on both Android and iOS. Pull request #9292
- Fixed iOS Firestore transaction timeout handling to prevent SDK retry loops when the JS bridge wait exceeds 15 seconds. Pull request #9303
- Pinned SPM Firebase SDK to declared version and retained ObjC categories to prevent Remote Config hangs and crashes. Pull request #9318
- Fixed Crashlytics SPM dSYM upload to resolve GoogleService-Info.plist from the correct ios/ folder location. Pull request #9305
- Fixed shell injection vulnerability in AI test fixture fetcher that could execute shell metacharacters from external git tags. Pull request #9293
Why it matters
This week addresses multiple security vulnerabilities including prototype pollution, code injection in build scripts, and shell injection in test tooling. Critical bug fixes for Firestore transactions, Remote Config stability, and authentication logging also prevent data leaks and runtime failures.
Changelog entry
- Firebase Android SDK updated to 34.19.0, iOS SDK to 12.19.0, and JS SDK to 12.19.0 Pull request #9317
- Crashlytics iOS: Fixed SPM dSYM upload to locate GoogleService-Info.plist in ios/ folder Pull request #9305
- Firestore iOS: Fixed runTransaction timeout handling to prevent SDK retry loops after 15s JS bridge timeout Pull request #9303
- App: Fixed prototype pollution vulnerability by rejecting __proto__, prototype, and constructor in deepSet path segments Pull request #9295
- App iOS: Fixed code injection vulnerability in ios_config.sh from unquoted firebase.json content in Ruby/Python evaluation Pull request #9294
- AI: Fixed shell injection vulnerability in test fixture fetcher from unquoted git tags Pull request #9293
- Auth: Removed sensitive authentication data from debug logs including verification IDs, phone numbers, and auth secrets Pull request #9292
- App iOS: Pinned SPM Firebase SDK to declared version and retained ObjC categories to fix Remote Config issues Pull request #9318
Weekly digest: Firebase SDK updates to 34.19.0/12.19.0, security fixes for prototype pollution and code injection vulnerabilities, Firestore transaction handling improved, and sensitive auth logs removed.
This week's release includes Firebase SDK updates (34.19.0 Android, 12.19.0 iOS/JS) alongside important security fixes. We addressed prototype pollution in deepSet, prevented code injection through firebase.json values in build scripts, and fixed shell injection in test tooling. Firestore transaction handling improved to prevent retry loops, Remote Config stability enhanced with proper SPM pinning, and sensitive authentication data removed from debug logs.