What invertase/react-native-firebase shipped

This week: iOS Crashlytics dSYM input now named after the executable. Build workers sized to available CPUs and memory. e2e releases only recorded resources. Android CI disk step fixed for ubuntu-26.04. Ruby install and Android lint hardened.

This week in the repository: the iOS Crashlytics configuration script phase now names its dSYM input after the executable, fixing path resolution for apps whose target name differs from the executable. Build entry points for lerna prepare and Gradle workers are now sized to the CPUs and memory the build can use rather than every core on the machine. End-to-end runs release only the resources a run recorded, with machine wipes left manual, and shared-host e2e scripts were hardened for slots, foreign Jet ports and TMPDIR. Android CI moved to v5.1 of remove-unwanted-software for the ubuntu-26.04 runner, fixing the Free Disk Space step that failed before tests ran. Ruby install, Android lint and host-dependent app tests were hardened, and scratch report files committed by accident were removed

Version 27.0.0 is out: Firebase Android 35, Apple 13 and JS 13, SPM-only iOS, and the discontinued ML package removed. 27.1.0 follows with Android 35.0.2, iOS 13.1.1 and JS 13.1.0. Firestore filter limits now match Firestore, and Crashlytics saves JS fatal reports before exiting

Release 27.0.0 brings Firebase Android 35 with minSdk raised to 24, Apple 13 and JS 13, moves iOS to SPM-only, and removes the discontinued @react-native-firebase/ml package. Release 27.1.0 follows with Firebase Android SDK 35.0.2, iOS SDK 13.1.1 and JS SDK 13.1.0. The v26 line received iOS SDK 12.19.3, the last major with CocoaPods support, which removes root certs for compromised eMudhra intermediate CAs. Firestore query filter limits were aligned with Firestore at 30 for in, or and and, and 10 for not-in. Crashlytics now saves the JS fatal report before exiting when exception handler chaining is disabled, and the SPM static linkage error message is clearer when use_frameworks is absent.

Messaging adds register, unregister, onRegistered and onUnregistered, with the token APIs deprecated and FID off by default. Database get() uses the native one-shot read on Android and web. iOS New Architecture null sentinels are decoded across Database, Auth, Analytics and Remot

This week: Messaging adds register, unregister, onRegistered and onUnregistered, with getToken, deleteToken and onTokenRefresh marked deprecated; the FID flag stays off by default and apps opt in through config. Database get() now uses the native one-shot read on Android and web. On iOS New Architecture, null sentinels are decoded across Database, Auth, Analytics and Remote Config, fixing stored null objects, profile clears and defaults. App and Database resolve the native module when bundlers apply package exports, fixing Realtime Database unsubscribe. Messaging hops UIApplication register APIs to the main queue and guards AppDelegate window access for UIScene apps, and Auth applies the reCAPTCHA openURL fix on the UIScene life cycle. App native helpers are ported to Kotlin and Swift behi

Weekly digest: Firebase SDK updates to 34.19.0/12.19.0, security fixes for prototype pollution and code injection vulnerabilities, Firestore transaction handling improved, and sensitive auth logs removed.

This week's release includes Firebase SDK updates (34.19.0 Android, 12.19.0 iOS/JS) alongside important security fixes. We addressed prototype pollution in deepSet, prevented code injection through firebase.json values in build scripts, and fixed shell injection in test tooling. Firestore transaction handling improved to prevent retry loops, Remote Config stability enhanced with proper SPM pinning, and sensitive authentication data removed from debug logs.