kreait/firebase-php

• Added support for guzzlehttp/guzzle:^8.0, guzzlehttp/psr7:^3.0 and guzzlehttp/promises:^3.0.
• Updated the firebase/php-jwt constraint to ^7.0.2.

• Added support for guzzlehttp/guzzle:^8.0, guzzlehttp/psr7:^3.0 and guzzlehttp/promises:^3.0.
• Updated the firebase/php-jwt constraint to ^7.0.2. Although CVE-2025-45769 is rated as low severity, it has been disputed on the basis that applications, rather than the library, are responsible for choosing appropriate key lengths. Nevertheless, a review of the library's most-downloaded dependents showed that most already support version 7.x.

Security improvements

• Restricted Realtime Database URLs to Firebase-owned hosts and reject non-root URLs with embedded paths, query strings, or fragments while preserving emulator support. Related OWASP Top 10:2025 entry: A02 Security Misconfiguration.
• Updated dependency mtdowling/jmespath.php to 2.9.2 to address CVE-2026-54133

Security improvements

• Restricted Realtime Database URLs to Firebase-owned hosts and reject non-root URLs with embedded paths, query strings, or fragments while preserving emulator support. Related OWASP Top 10:2025 entry: A02 Security Misconfiguration.
• Updated dependency mtdowling/jmespath.php to 2.9.2 to address CVE-2026-54133

• Added support for Unicode characters in email addresses.

App Check

• Added replay-protection verification for App Check tokens via verifyTokenWithReplayProtection(). The response now includes alreadyConsumed when replay protection is used.
• Added transitional contract Kreait\Firebase\Contract\AppCheckWithReplayProtection. This was introduced to preserve backwards compatibility by avoiding a signature change to Kreait\Firebase\Contract\AppCheck::verifyToken() in the current major release.
• Added dedicated exception Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckReplayProtection for replay-protection verification failures. It extends Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckToken for backwards compatibility.

• Added support for Unicode characters in email addresses.

App Check

• Added replay-protection verification for App Check tokens via verifyTokenWithReplayProtection(). The response now includes alreadyConsumed when replay protection is used.
• Added transitional contract Kreait\Firebase\Contract\AppCheckWithReplayProtection. This was introduced to preserve backwards compatibility by avoiding a signature change to Kreait\Firebase\Contract\AppCheck::verifyToken() in the current major release.
• Added dedicated exception Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckReplayProtection for replay-protection verification failures. It extends Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckToken for backwards compatibility.

Added support for firebase/php-jwt:^7.0.2

• Added support for firebase/php-jwt:^7.0.2

Security improvements

• Added #[SensitiveParameter] attributes to methods handling sensitive data (passwords, tokens, private keys)
  to prevent them from appearing in stack traces and error logs.

Breaking changes

• The SDK supports only actively supported PHP versions. As a result, support for PHP < 8.3 has been dropped;
  supported versions are 8.3, 8.4, and 8.5.
• Firebase Dynamic Links was shut down on August 25th, 2025
  and has been removed from the SDK.
• Deprecated classes, methods and class constants have been removed.
• Method arguments are now fully type-hinted
• Type declarations have been simplified to reduce runtime overhead (e.g., Stringable|string to string).
• The transitional Kreait\Firebase\Contract\Transitional\FederatedUserFetcher::getUserByProviderUid() method
  has been moved into the Kreait\Firebase\Contract\Auth interface
• Realtime Database objects considered value objects have been made final and readonly
• psr/log has been moved from runtime dependencies to development dependencies
• Kreait\Firebase\Contract\Messaging::BATCH_MESSAGE_LIMIT constant has been removed
• Exception codes are no longer preserved when wrapping exceptions
• Kreait\Firebase\Messaging\CloudMessage builder methods have been renamed to follow the with* pattern:
  toToken() -> withToken(), toTopic() -> withTopic(), toCondition() -> withCondition().
  The old methods are deprecated but still available as aliases.

See UPGRADE-8.0 for more details on the changes between 7.x and 8.0.

7.x Changelog

https://github.com/kreait/firebase-php/blob/7.24.0/CHANGELOG.md

Security improvements

• Added #[SensitiveParameter] attributes to methods handling sensitive data (passwords, tokens, private keys) to prevent them from appearing in stack traces and error logs.

Breaking changes

• The SDK supports only actively supported PHP versions. As a result, support for PHP < 8.3 has been dropped; supported versions are 8.3, 8.4, and 8.5.
• Firebase Dynamic Links was shut down on August 25th, 2025 and has been removed from the SDK.
• Deprecated classes, methods and class constants have been removed.
• Method arguments are now fully type-hinted
• Type declarations have been simplified to reduce runtime overhead (e.g., Stringable|string to string).
• The transitional Kreait\Firebase\Contract\Transitional\FederatedUserFetcher::getUserByProviderUid() method has been moved into the Kreait\Firebase\Contract\Auth interface
• Realtime Database objects considered value objects have been made final and readonly
• psr/log has been moved from runtime dependencies to development dependencies
• Kreait\Firebase\Contract\Messaging::BATCH_MESSAGE_LIMIT constant has been removed
• Exception codes are no longer preserved when wrapping exceptions
• Kreait\Firebase\Messaging\CloudMessage builder methods have been renamed to follow the with* pattern: toToken() -> withToken(), toTopic() -> withTopic(), toCondition() -> withCondition(). The old methods are deprecated but still available as aliases.

See UPGRADE-8.0 for more details on the changes between 7.x and 8.0.

Added support for firebase/php-jwt:^7.0.2 to remediate the vulnerabilities PKSA-y2cr-5h3j-g3ys and CVE-2025-4659.

Changed

• Realtime Database references are now validated by the API instead of locally. Validation rules can change at any time, and the SDK can only adapt to changes in the API. While local checks could prevent obviously invalid paths, they'd also require an SDK update whenever Firebase loosens a rule. Developers can be trusted not to use invalid paths 😅.
• Removed the #[SensitiveParameter] attribute again, because it's supported by PHP 8.1 itself, but not in combination with Valinor. (#1034)

Require cuyz/valinor:^2.2.1 for better mapping.

Added

• Added support for PHP 8.5

Changed

• The project now features a custom logo (I came up with it myself, and took the wise decision to not look up if there's something similar already)
• Refined README for improved clarity, removed outdated documentation sections, and streamlined project support messaging with a more positive call to action
• Documentation now uses the modern Furo theme, providing a cleaner and more pleasant reading experience

Fixed

• Re-added the #[SensitiveParameter] attribute because, while it's not supported in PHP 8.1, it can still be used if placed in a standalone line above the variable or property.
• Re-added support for JSON files with any file extension
• With the introduction of Valinor, Service Account credentials were required to have more fields than necessary to work with the SDK, although it only needs the client email, private key, and project ID.