Skip to content

Bump undici, @react-native-firebase/app and @react-native-firebase/messaging#6051

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/multi-7b5809e71b
Open

Bump undici, @react-native-firebase/app and @react-native-firebase/messaging#6051
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/multi-7b5809e71b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 23, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps undici to 6.27.0 and updates ancestor dependencies undici, @react-native-firebase/app and @react-native-firebase/messaging. These dependencies need to be updated together.

Updates undici from 6.21.3 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

  • Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
  • Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Updates @react-native-firebase/app from 20.5.0 to 25.1.0

Release notes

Sourced from @​react-native-firebase/app's releases.

v24.1.1

Bug Fixes

  • ios: revert to firebase-ios-sdk 12.10.0 to avoid startup crash (b97bc26)

v24.1.0

Features

  • analytics: add Expo config plugin for withoutAdIdSupport (#8969) (5af7a6a)
  • analytics: add support for googleAppMeasurementOnDeviceConversion in iOS Expo plugin (#9014) (a7a5125)
  • firestore: add 'source' option to enable local cache firestore listeners (e3ce410)

Bug Fixes

  • analytics: cast item INDEX param to integer (915dc8a)
  • analytics: coerce all number params from js double to native integral (760ddd2)
  • analytics: success param type now boolean - never worked before, now works (7e122b2)
  • android: catch RejectedExecutionException on executor-backed Tasks (375ade9)
  • database, android: remove RTDB listeners before shutting down executors (25ed605)
  • docs: workflow to generate+publish API docs, call same on publish (8222a96)
  • firebase-android-sdk 34.14.0, firebase-ios-sdk 12.11.0, firebase-js-sdk 12.14.0 (65bbe94)
  • firestore, android: catch RejectedExecutionException in sendOnSnapshotEvent (602d7ad)
  • firestore: restore generic root type exports for DocumentSnapshot, Transaction, and WriteBatch (#8997) (9809622)

v24.0.0

⚠ BREAKING CHANGES

  • firestore: migrate to TypeScript and match firebase-js-sdk (#8892)
  • firestore: typescript - firestore types now match modular firebase-js-sdk - see migration guide

Please see https://rnfirebase.io/migrating-to-v24 for a guide on updating your types if you were using the previous firestore typescript types.

In general everything should behave the same as v23 but the typescript types have changed. It is our hope you as a developer can adopt these changes easily and your app works exactly the same.

It is always our goal to be a drop-in replacement for firebase-js-sdk, type for type, API for API. In general all firestore types should now be the same as the firestore modular types from firebase-js-sdk

  • functions: you must enable new architecture to use the functions module All modules will be converted to new architecture soon, old architecture support is deprecated in general for react-native-firebase

Features

  • firestore: Support for Firestore pipelines API (#8931) (54021c4)
  • firestore: implement withConverter (#8744) (13d6bb3)
  • ai: CodeExecutionTool types for allowing model to run code (#8866) (81a0f19)

... (truncated)

Changelog

Sourced from @​react-native-firebase/app's changelog.

25.1.0 (2026-06-25)

Features

  • firestore: variable() and arrayFilter() API features for pipelines (#9017) (cbe2593)

Bug Fixes

  • auth, perf: correctly export expo config plugin, add test for same (dfb8126)

25.0.1 (2026-06-23)

Bug Fixes

  • auth: export revokeToken in modular API for Sign in with Apple (a05fa66), closes #9070

25.0.0 (2026-06-23)

⚠ BREAKING CHANGES

  • auth: migrate to TypeScript and bring auth closer in alignment with firebase-js-sdk API (#8991)
  • messaging: deprecate permissions APIs, use react-native-permissions or expo-notifications (#9053)
  • installations: installations modular types now match firebase-js-sdk

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Installations:

changed modular getInstallations() to return the firebase-js-sdk-style Installations type, which only exposes app; TypeScript consumers should use the modular helpers getId(installations), getToken(installations), and deleteInstallations(installations) instead of calling .getId(), .getToken(), or .delete() on the returned instance. changed modular deleteInstallations(installations) so the installations argument is required in the TypeScript surface, matching firebase-js-sdk. Code that previously relied on the old optional typing should pass getInstallations() explicitly. preserved the namespaced API surface: installations(), firebase.installations(), firebase.app().installations(), and FirebaseInstallationsTypes.Module remain available for compatibility, with deprecation annotations added. added explicit modular public types including Installations, IdChangeCallbackFn, and IdChangeUnsubscribeFn.

  • perf: perf types now match firebase-js-sdk as closely as possible

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Performance:

  • changed modular initializePerformance(app, settings) to return FirebasePerformance synchronously instead of Promise<Performance>, matching firebase-js-sdk; TypeScript consumers that call .then(...) on it will need to use the returned instance directly.
  • aligned the modular FirebasePerformance type with firebase-js-sdk, so it no longer exposes older namespaced instance-style methods such as newTrace, startTrace, newHttpMetric, newScreenTrace, startScreenTrace, or setPerformanceCollectionEnabled in the modular typings; use trace(perf, name), httpMetric(perf, url, method), newScreenTrace(perf, name), startScreenTrace(perf, name), and the dataCollectionEnabled property instead.
  • changed PerformanceSettings to the firebase-js-sdk shape, with optional dataCollectionEnabled and instrumentationEnabled.

... (truncated)

Commits
  • e0a565d chore(release): release packages
  • dfb8126 fix(auth, perf): correctly export expo config plugin, add test for same
  • 93310ce chore(ci): grant pull-requests write to issue labeler workflow
  • 34fce0e docs(firestore): add pipelines overview and SDK compatibility pages
  • cbe2593 feat(firestore): variable() and arrayFilter() API features for pipelines...
  • d3c4110 test(e2e): fix mocha-remote parse patch and macOS Metro bundle startup
  • 11a2fa2 test(ios): e2e orchestration flake mitigation
  • 1af1f3b test(android): mitigate android emulator startup and orchestration stabiity f...
  • 2381efb test(ci): add Android e2e resource monitor
  • 8394a52 test(ios): add tart ephemeral e2e reproduction pipeline
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​react-native-firebase/app since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @react-native-firebase/messaging from 20.5.0 to 25.1.0

Release notes

Sourced from @​react-native-firebase/messaging's releases.

v24.1.1

Bug Fixes

  • ios: revert to firebase-ios-sdk 12.10.0 to avoid startup crash (b97bc26)

v24.1.0

Features

  • analytics: add Expo config plugin for withoutAdIdSupport (#8969) (5af7a6a)
  • analytics: add support for googleAppMeasurementOnDeviceConversion in iOS Expo plugin (#9014) (a7a5125)
  • firestore: add 'source' option to enable local cache firestore listeners (e3ce410)

Bug Fixes

  • analytics: cast item INDEX param to integer (915dc8a)
  • analytics: coerce all number params from js double to native integral (760ddd2)
  • analytics: success param type now boolean - never worked before, now works (7e122b2)
  • android: catch RejectedExecutionException on executor-backed Tasks (375ade9)
  • database, android: remove RTDB listeners before shutting down executors (25ed605)
  • docs: workflow to generate+publish API docs, call same on publish (8222a96)
  • firebase-android-sdk 34.14.0, firebase-ios-sdk 12.11.0, firebase-js-sdk 12.14.0 (65bbe94)
  • firestore, android: catch RejectedExecutionException in sendOnSnapshotEvent (602d7ad)
  • firestore: restore generic root type exports for DocumentSnapshot, Transaction, and WriteBatch (#8997) (9809622)

v24.0.0

⚠ BREAKING CHANGES

  • firestore: migrate to TypeScript and match firebase-js-sdk (#8892)
  • firestore: typescript - firestore types now match modular firebase-js-sdk - see migration guide

Please see https://rnfirebase.io/migrating-to-v24 for a guide on updating your types if you were using the previous firestore typescript types.

In general everything should behave the same as v23 but the typescript types have changed. It is our hope you as a developer can adopt these changes easily and your app works exactly the same.

It is always our goal to be a drop-in replacement for firebase-js-sdk, type for type, API for API. In general all firestore types should now be the same as the firestore modular types from firebase-js-sdk

  • functions: you must enable new architecture to use the functions module All modules will be converted to new architecture soon, old architecture support is deprecated in general for react-native-firebase

Features

  • firestore: Support for Firestore pipelines API (#8931) (54021c4)
  • firestore: implement withConverter (#8744) (13d6bb3)
  • ai: CodeExecutionTool types for allowing model to run code (#8866) (81a0f19)

... (truncated)

Changelog

Sourced from @​react-native-firebase/messaging's changelog.

25.1.0 (2026-06-25)

Features

  • firestore: variable() and arrayFilter() API features for pipelines (#9017) (cbe2593)

Bug Fixes

  • auth, perf: correctly export expo config plugin, add test for same (dfb8126)

25.0.1 (2026-06-23)

Bug Fixes

  • auth: export revokeToken in modular API for Sign in with Apple (a05fa66), closes #9070

25.0.0 (2026-06-23)

⚠ BREAKING CHANGES

  • auth: migrate to TypeScript and bring auth closer in alignment with firebase-js-sdk API (#8991)
  • messaging: deprecate permissions APIs, use react-native-permissions or expo-notifications (#9053)
  • installations: installations modular types now match firebase-js-sdk

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Installations:

changed modular getInstallations() to return the firebase-js-sdk-style Installations type, which only exposes app; TypeScript consumers should use the modular helpers getId(installations), getToken(installations), and deleteInstallations(installations) instead of calling .getId(), .getToken(), or .delete() on the returned instance. changed modular deleteInstallations(installations) so the installations argument is required in the TypeScript surface, matching firebase-js-sdk. Code that previously relied on the old optional typing should pass getInstallations() explicitly. preserved the namespaced API surface: installations(), firebase.installations(), firebase.app().installations(), and FirebaseInstallationsTypes.Module remain available for compatibility, with deprecation annotations added. added explicit modular public types including Installations, IdChangeCallbackFn, and IdChangeUnsubscribeFn.

  • perf: perf types now match firebase-js-sdk as closely as possible

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Performance:

  • changed modular initializePerformance(app, settings) to return FirebasePerformance synchronously instead of Promise<Performance>, matching firebase-js-sdk; TypeScript consumers that call .then(...) on it will need to use the returned instance directly.
  • aligned the modular FirebasePerformance type with firebase-js-sdk, so it no longer exposes older namespaced instance-style methods such as newTrace, startTrace, newHttpMetric, newScreenTrace, startScreenTrace, or setPerformanceCollectionEnabled in the modular typings; use trace(perf, name), httpMetric(perf, url, method), newScreenTrace(perf, name), startScreenTrace(perf, name), and the dataCollectionEnabled property instead.
  • changed PerformanceSettings to the firebase-js-sdk shape, with optional dataCollectionEnabled and instrumentationEnabled.

... (truncated)

Commits
  • e0a565d chore(release): release packages
  • dfb8126 fix(auth, perf): correctly export expo config plugin, add test for same
  • 93310ce chore(ci): grant pull-requests write to issue labeler workflow
  • 34fce0e docs(firestore): add pipelines overview and SDK compatibility pages
  • cbe2593 feat(firestore): variable() and arrayFilter() API features for pipelines...
  • d3c4110 test(e2e): fix mocha-remote parse patch and macOS Metro bundle startup
  • 11a2fa2 test(ios): e2e orchestration flake mitigation
  • 1af1f3b test(android): mitigate android emulator startup and orchestration stabiity f...
  • 2381efb test(ci): add Android e2e resource monitor
  • 8394a52 test(ios): add tart ephemeral e2e reproduction pipeline
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​react-native-firebase/messaging since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Note

High Risk
Major react-native-firebase jump (20→25) affects push/messaging native stacks and may require Android Firebase Messaging Gradle alignment; undici bump is security-motivated but low direct app surface.

Overview
Dependency-only update in package.json and package-lock.json: @react-native-firebase/app and @react-native-firebase/messaging move from 20.5.0 → 25.1.0, which pulls firebase JS 12.15.0 and a large refresh of @firebase/* packages (including new @firebase/ai / @firebase/data-connect, updated messaging, and removal of superstruct from the app package).

undici is bumped transitively to 6.27.0 (security fixes for WebSocket DoS, cookie/header handling, and related advisories).

There are no application source changes in this diff. After merge, expect native rebuilds (pod install, Android Gradle) and sanity checks on push notifications (FCM token refresh in native code). Note: android/app/build.gradle still pins com.google.firebase:firebase-messaging:23.0.0 with a comment to keep it in sync with react-native-firebase—that pin is unchanged here and may need a follow-up when validating Android builds.

If the app uses RN Firebase modular TypeScript APIs or messaging permission helpers, v25 breaking changes (see migrating-to-v25) could surface at compile time; namespaced usage and react-native-permissions for notification permission align with the deprecation direction.

Reviewed by Cursor Bugbot for commit 5866026. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 23, 2026
@dependabot dependabot Bot mentioned this pull request Jun 23, 2026
Closed
@socket-security

socket-security Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​react-native-firebase/​app@​20.5.0 ⏵ 25.1.010010089 +19880
Updated@​react-native-firebase/​messaging@​20.5.0 ⏵ 25.1.010010091 +19880

View full report

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-7b5809e71b branch 9 times, most recently from 3449643 to e5e06ab Compare July 7, 2026 01:44
@dependabot
Bump undici, @react-native-firebase/app and @react-native-firebase/me…
5866026 
…ssaging

Bumps [undici](https://github.com/nodejs/undici) to 6.27.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@react-native-firebase/app](https://github.com/invertase/react-native-firebase) and [@react-native-firebase/messaging](https://github.com/invertase/react-native-firebase). These dependencies need to be updated together.


Updates `undici` from 6.21.3 to 6.27.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v6.27.0)

Updates `@react-native-firebase/app` from 20.5.0 to 25.1.0
- [Release notes](https://github.com/invertase/react-native-firebase/releases)
- [Changelog](https://github.com/invertase/react-native-firebase/blob/main/CHANGELOG.md)
- [Commits](invertase/react-native-firebase@v20.5.0...v25.1.0)

Updates `@react-native-firebase/messaging` from 20.5.0 to 25.1.0
- [Release notes](https://github.com/invertase/react-native-firebase/releases)
- [Changelog](https://github.com/invertase/react-native-firebase/blob/main/CHANGELOG.md)
- [Commits](invertase/react-native-firebase@v20.5.0...v25.1.0)

---
updated-dependencies:
- dependency-name: "@react-native-firebase/app"
  dependency-version: 25.0.1
  dependency-type: direct:production
- dependency-name: "@react-native-firebase/messaging"
  dependency-version: 25.0.1
  dependency-type: direct:production
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-7b5809e71b branch from e5e06ab to 5866026 Compare July 11, 2026 01:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants