Skip to content

CHANGELOG.md

Latest commit

 

History

History
67 lines (48 loc) · 3.38 KB

CHANGELOG.md

File metadata and controls

67 lines (48 loc) · 3.38 KB

CHANGELOG

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications. If it saves you or your team time, please consider sponsoring its development.

Repository move: The project moved from the kreait to the beste GitHub Organization in January 2026. The namespace remains Kreait\Firebase and the package name remains kreait/firebase-php. Please update your remote URL if you have forked or cloned the repository.

Unreleased

Security improvements

  • Restricted Realtime Database URLs to Firebase-owned hosts and reject non-root URLs with embedded paths, query strings, or fragments while preserving emulator support. Related OWASP Top 10:2025 entry: A02 Security Misconfiguration.

8.2.0 - 2026-03-04

  • Added support for Unicode characters in email addresses.

App Check

  • Added replay-protection verification for App Check tokens via verifyTokenWithReplayProtection(). The response now includes alreadyConsumed when replay protection is used.
  • Added transitional contract Kreait\Firebase\Contract\AppCheckWithReplayProtection. This was introduced to preserve backwards compatibility by avoiding a signature change to Kreait\Firebase\Contract\AppCheck::verifyToken() in the current major release.
  • Added dedicated exception Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckReplayProtection for replay-protection verification failures. It extends Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckToken for backwards compatibility.

8.1.0 - 2026-01-23

  • Added support for firebase/php-jwt:^7.0.2

8.0.0 - 2026-01-08

Security improvements

  • Added #[SensitiveParameter] attributes to methods handling sensitive data (passwords, tokens, private keys) to prevent them from appearing in stack traces and error logs.

Breaking changes

  • The SDK supports only actively supported PHP versions. As a result, support for PHP < 8.3 has been dropped; supported versions are 8.3, 8.4, and 8.5.
  • Firebase Dynamic Links was shut down on August 25th, 2025 and has been removed from the SDK.
  • Deprecated classes, methods and class constants have been removed.
  • Method arguments are now fully type-hinted
  • Type declarations have been simplified to reduce runtime overhead (e.g., Stringable|string to string).
  • The transitional Kreait\Firebase\Contract\Transitional\FederatedUserFetcher::getUserByProviderUid() method has been moved into the Kreait\Firebase\Contract\Auth interface
  • Realtime Database objects considered value objects have been made final and readonly
  • psr/log has been moved from runtime dependencies to development dependencies
  • Kreait\Firebase\Contract\Messaging::BATCH_MESSAGE_LIMIT constant has been removed
  • Exception codes are no longer preserved when wrapping exceptions
  • Kreait\Firebase\Messaging\CloudMessage builder methods have been renamed to follow the with* pattern: toToken() -> withToken(), toTopic() -> withTopic(), toCondition() -> withCondition(). The old methods are deprecated but still available as aliases.

See UPGRADE-8.0 for more details on the changes between 7.x and 8.0.

7.x Changelog

https://github.com/beste/firebase-php/blob/7.24.0/CHANGELOG.md
⚡