[dependabot]

Bumps firebase from 13.1.0 to 13.2.0.

Release notes

Sourced from firebase's releases.

firebase@13.2.0

For more detailed release notes, see Firebase JavaScript SDK Release Notes.

What's Changed

@​firebase/crashlytics@​0.1.0

Minor Changes

• fe5dd06 #10548 - First release of Crashlytics for public preview

firebase@13.2.0

Minor Changes

• fe5dd06 #10548 - First release of Crashlytics for public preview

Patch Changes

• Updated dependencies [3da3c2b, fe5dd06, 3a5d6a0, 0079975]:
• @​firebase/auth@​1.13.9
• @​firebase/app@​0.16.5
• @​firebase/crashlytics@​0.1.0
• @​firebase/firestore@​4.19.1
• @​firebase/auth-compat@​0.6.14
• @​firebase/app-compat@​0.5.21
• @​firebase/firestore-compat@​0.4.17

@​firebase/app@​0.16.5

Patch Changes

• fe5dd06 #10548 - First release of Crashlytics for public preview

@​firebase/app-compat@​0.5.21

Patch Changes

• Updated dependencies [fe5dd06]:
• @​firebase/app@​0.16.5

@​firebase/auth@​1.13.9

Patch Changes

• 3da3c2b #10535 - Update the on-demand ID token expiration buffer (Buffer.TOKEN_REFRESH) from 30 seconds to 5 minutes to match User.getIdToken() documentation and the proactive refresh offset.

• 0079975 #10393 - - Fix an unhandled exception when a popup or redirect operation (e.g., signInWithPopup) is cancelled by a second call before the first operation finishes initializing.

• Fix an unhandled promise rejection during initial IndexedDB cache population if the page navigates away or is backgrounded while loading.

• Fix an uncatchable unhandled promise rejection when background reCAPTCHA Enterprise token verification fails during initializeRecaptchaConfig or signInWithPhoneNumber.

@​firebase/auth-compat@​0.6.14

Patch Changes

... (truncated)

Commits

• 632df79 Version Packages (#10567)
• a160057 Merge main into release
• fe5dd06 Merge branch "crashlytics2" into main (#10548)
• 7b67f3b test(messaging): remove integration/messaging test dir (#10537)
• 0079975 test(auth): migrate tests to Vitest (#10393)
• 3da3c2b fix(auth): update token expiration buffer to 5 minutes (#10535)
• 9e34f34 ci: bump CI Node to 24.22.1 (Oct 2026 security release) (#10506)
• 598d636 test(rules-unit-testing): migrate unit and emulator tests from Mocha to Vites...
• 3a5d6a0 fix(firestore): graduate pipeline search from preview to GA (#10519)
• af652d9 chore: upgrade playwright to 1.64.1 (#10505)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​firebase@​13.1.0 ⏵ 13.2.0			+1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Network access: npm @firebase/crashlytics in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@firebase/crashlytics@0.1.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@firebase/crashlytics@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm @opentelemetry/resources in module child_process Module: child_process Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/resources@2.10.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/resources@2.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm @opentelemetry/resources in module child_process Module: child_process Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/resources@2.9.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/resources@2.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Deprecated by its maintainer: npm @opentelemetry/sdk-trace-base Reason: Use @opentelemetry/sdk-trace package From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/sdk-trace-base@2.10.0 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/sdk-trace-base@2.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm @firebase/crashlytics URLs: https://clienttelemetry.googleapis.com Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@firebase/crashlytics@0.1.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@firebase/crashlytics@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm @opentelemetry/browser-instrumentation URLs: browser.user_action.click, browser.web_vital.name, browser.web_vital.delta, browser.web_vital.id Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/browser-instrumentation@0.6.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/browser-instrumentation@0.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Environment variable access: npm @opentelemetry/core Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/core@2.10.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/core@2.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Environment variable access: npm @opentelemetry/core Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/core@2.9.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/core@2.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm @opentelemetry/instrumentation-fetch with http.host URLs: http.host Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/instrumentation-fetch@0.220.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/instrumentation-fetch@0.220.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm @opentelemetry/instrumentation-xml-http-request with http.host URLs: http.host Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/instrumentation-xml-http-request@0.220.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/instrumentation-xml-http-request@0.220.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Filesystem access: npm @opentelemetry/instrumentation with module fs Module: fs Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/instrumentation@0.220.0 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/instrumentation@0.220.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Environment variable access: npm @opentelemetry/resources Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/resources@2.10.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/resources@2.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Filesystem access: npm @opentelemetry/resources with module fs Module: fs Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/resources@2.10.0 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/resources@2.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Environment variable access: npm @opentelemetry/resources Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/resources@2.9.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/resources@2.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Filesystem access: npm @opentelemetry/resources with module fs Module: fs Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/@opentelemetry/resources@2.9.0 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/resources@2.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm firebase URLs: https://apis.google.com/js/api.js, https://clienttelemetry.googleapis.com, https://console.firebase.google.com/., https://console.firebase.google.com/project/, https://content-firebaseappcheck.googleapis.com/v1, https://fcmregistrations.googleapis.com/v1, https://fcmregistrations.googleapis.com/v1/projects/, https://firebase.google.com/docs/app-check/web/debug-provider, https://firebase.google.com/docs/cli, https://firebase.google.com/docs/web/environments-js-sdk#polyfills, https://firebase.google.com/pricing/., https://firebase.googleapis.com/v1alpha/projects/-/apps/, https://firebaseinstallations.googleapis.com/v1, https://firebaseinstallations.googleapis.com/v1/projects/, https://firebaselogging.googleapis.com/v0cc/log?format=json_proto, https://firebaseremoteconfig.googleapis.com, https://firebaseremoteconfig.googleapis.com/v1/projects/, https://firebaseremoteconfigrealtime.googleapis.com, https://github.com/nodejs/require-in-the-middle/issues, https://play.google.com/log?format=json_proto3, https://securetoken.google.com/, https://stackoverflow.com/q/56496296/110915, https://www.google.com/recaptcha/api.js, https://www.google.com/recaptcha/enterprise.js, https://www.google.com/recaptcha/enterprise.js?render=, https://www.googletagmanager.com/gtag/js, https://www.gstatic.com/firebasejs/13.2.0/firebase-app.js Location: Package overview From: package.json → npm/firebase@13.2.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/firebase@13.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Debug access: npm import-in-the-middle in module module Module: module Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/import-in-the-middle@3.5.3 ℹ Read more on: This package | This alert | What is debug access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing the use of debug will reduce the risk of any reflection and dynamic code execution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/import-in-the-middle@3.5.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Environment variable access: npm import-in-the-middle reads TURBOPACK Env Vars: TURBOPACK Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/import-in-the-middle@3.5.3 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/import-in-the-middle@3.5.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm import-in-the-middle URLs: https://github.com/nodejs/node/pull/59929 Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/import-in-the-middle@3.5.3 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/import-in-the-middle@3.5.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Debug access: npm require-in-the-middle in module module Module: module Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/require-in-the-middle@8.0.1 ℹ Read more on: This package | This alert | What is debug access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing the use of debug will reduce the risk of any reflection and dynamic code execution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/require-in-the-middle@8.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Embedded URLs or IPs: npm require-in-the-middle URLs: https://github.com/nodejs/require-in-the-middle/issues Location: Package overview From: package.json → npm/firebase@13.2.0 → npm/require-in-the-middle@8.0.1 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/require-in-the-middle@8.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block

View full report