Bump undici, @react-native-firebase/app and @react-native-firebase/messaging

[dependabot]

Bumps undici to 6.27.0 and updates ancestor dependencies undici, @react-native-firebase/app and @react-native-firebase/messaging. These dependencies need to be updated together.

Updates undici from 6.21.3 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	b7f252e7
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	25efa447
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	25efa447
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	f4c31d60

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

---

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

• 551138c Bumped v6.27.0 (#5431)
• b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
• 25efa44 fix(cookies): preserve values and parse SameSite strictly
• f4c31d6 fix: guard idle socket validation to skip fresh sockets (#5400)
• 768beac Bumped v6.26.0 (#5323)
• 7917b25 fix: validate EOF for chunked h1 responses (#5308)
• 3420499 Bumped v6.25.0 (#5029)
• d7a1e55 feat: add configurable maxPayloadSize for WebSocket (#4955)
• a9d1848 Do not mark v6.x releases as latest
• 0126586 Ignore local agent configuration files
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Updates @react-native-firebase/app from 20.5.0 to 25.1.0

Release notes

Sourced from @​react-native-firebase/app's releases.

v24.1.1

Bug Fixes

• ios: revert to firebase-ios-sdk 12.10.0 to avoid startup crash (b97bc26)

v24.1.0

Features

• analytics: add Expo config plugin for withoutAdIdSupport (#8969) (5af7a6a)
• analytics: add support for googleAppMeasurementOnDeviceConversion in iOS Expo plugin (#9014) (a7a5125)
• firestore: add 'source' option to enable local cache firestore listeners (e3ce410)

Bug Fixes

• analytics: cast item INDEX param to integer (915dc8a)
• analytics: coerce all number params from js double to native integral (760ddd2)
• analytics: success param type now boolean - never worked before, now works (7e122b2)
• android: catch RejectedExecutionException on executor-backed Tasks (375ade9)
• database, android: remove RTDB listeners before shutting down executors (25ed605)
• docs: workflow to generate+publish API docs, call same on publish (8222a96)
• firebase-android-sdk 34.14.0, firebase-ios-sdk 12.11.0, firebase-js-sdk 12.14.0 (65bbe94)
• firestore, android: catch RejectedExecutionException in sendOnSnapshotEvent (602d7ad)
• firestore: restore generic root type exports for DocumentSnapshot, Transaction, and WriteBatch (#8997) (9809622)

v24.0.0

⚠ BREAKING CHANGES

• firestore: migrate to TypeScript and match firebase-js-sdk (#8892)
• firestore: typescript - firestore types now match modular firebase-js-sdk - see migration guide

Please see https://rnfirebase.io/migrating-to-v24 for a guide on updating your types if you were using the previous firestore typescript types.

In general everything should behave the same as v23 but the typescript types have changed. It is our hope you as a developer can adopt these changes easily and your app works exactly the same.

It is always our goal to be a drop-in replacement for firebase-js-sdk, type for type, API for API. In general all firestore types should now be the same as the firestore modular types from firebase-js-sdk

• functions: you must enable new architecture to use the functions module All modules will be converted to new architecture soon, old architecture support is deprecated in general for react-native-firebase

Features

• firestore: Support for Firestore pipelines API (#8931) (54021c4)
• firestore: implement withConverter (#8744) (13d6bb3)
• ai: CodeExecutionTool types for allowing model to run code (#8866) (81a0f19)

... (truncated)

Changelog

Sourced from @​react-native-firebase/app's changelog.

25.1.0 (2026-06-25)

Features

• firestore: variable() and arrayFilter() API features for pipelines (#9017) (cbe2593)

Bug Fixes

• auth, perf: correctly export expo config plugin, add test for same (dfb8126)

25.0.1 (2026-06-23)

Bug Fixes

• auth: export revokeToken in modular API for Sign in with Apple (a05fa66), closes #9070

25.0.0 (2026-06-23)

⚠ BREAKING CHANGES

• auth: migrate to TypeScript and bring auth closer in alignment with firebase-js-sdk API (#8991)
• messaging: deprecate permissions APIs, use react-native-permissions or expo-notifications (#9053)
• installations: installations modular types now match firebase-js-sdk

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Installations:

changed modular getInstallations() to return the firebase-js-sdk-style Installations type, which only exposes app; TypeScript consumers should use the modular helpers getId(installations), getToken(installations), and deleteInstallations(installations) instead of calling .getId(), .getToken(), or .delete() on the returned instance. changed modular deleteInstallations(installations) so the installations argument is required in the TypeScript surface, matching firebase-js-sdk. Code that previously relied on the old optional typing should pass getInstallations() explicitly. preserved the namespaced API surface: installations(), firebase.installations(), firebase.app().installations(), and FirebaseInstallationsTypes.Module remain available for compatibility, with deprecation annotations added. added explicit modular public types including Installations, IdChangeCallbackFn, and IdChangeUnsubscribeFn.

• perf: perf types now match firebase-js-sdk as closely as possible

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Performance:

• changed modular initializePerformance(app, settings) to return FirebasePerformance synchronously instead of Promise<Performance>, matching firebase-js-sdk; TypeScript consumers that call .then(...) on it will need to use the returned instance directly.
• aligned the modular FirebasePerformance type with firebase-js-sdk, so it no longer exposes older namespaced instance-style methods such as newTrace, startTrace, newHttpMetric, newScreenTrace, startScreenTrace, or setPerformanceCollectionEnabled in the modular typings; use trace(perf, name), httpMetric(perf, url, method), newScreenTrace(perf, name), startScreenTrace(perf, name), and the dataCollectionEnabled property instead.
• changed PerformanceSettings to the firebase-js-sdk shape, with optional dataCollectionEnabled and instrumentationEnabled.

... (truncated)

Commits

• e0a565d chore(release): release packages
• dfb8126 fix(auth, perf): correctly export expo config plugin, add test for same
• 93310ce chore(ci): grant pull-requests write to issue labeler workflow
• 34fce0e docs(firestore): add pipelines overview and SDK compatibility pages
• cbe2593 feat(firestore): variable() and arrayFilter() API features for pipelines...
• d3c4110 test(e2e): fix mocha-remote parse patch and macOS Metro bundle startup
• 11a2fa2 test(ios): e2e orchestration flake mitigation
• 1af1f3b test(android): mitigate android emulator startup and orchestration stabiity f...
• 2381efb test(ci): add Android e2e resource monitor
• 8394a52 test(ios): add tart ephemeral e2e reproduction pipeline
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​react-native-firebase/app since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @react-native-firebase/messaging from 20.5.0 to 25.1.0

Release notes

Sourced from @​react-native-firebase/messaging's releases.

v24.1.1

Bug Fixes

• ios: revert to firebase-ios-sdk 12.10.0 to avoid startup crash (b97bc26)

v24.1.0

Features

• analytics: add Expo config plugin for withoutAdIdSupport (#8969) (5af7a6a)
• analytics: add support for googleAppMeasurementOnDeviceConversion in iOS Expo plugin (#9014) (a7a5125)
• firestore: add 'source' option to enable local cache firestore listeners (e3ce410)

Bug Fixes

• analytics: cast item INDEX param to integer (915dc8a)
• analytics: coerce all number params from js double to native integral (760ddd2)
• analytics: success param type now boolean - never worked before, now works (7e122b2)
• android: catch RejectedExecutionException on executor-backed Tasks (375ade9)
• database, android: remove RTDB listeners before shutting down executors (25ed605)
• docs: workflow to generate+publish API docs, call same on publish (8222a96)
• firebase-android-sdk 34.14.0, firebase-ios-sdk 12.11.0, firebase-js-sdk 12.14.0 (65bbe94)
• firestore, android: catch RejectedExecutionException in sendOnSnapshotEvent (602d7ad)
• firestore: restore generic root type exports for DocumentSnapshot, Transaction, and WriteBatch (#8997) (9809622)

v24.0.0

⚠ BREAKING CHANGES

• firestore: migrate to TypeScript and match firebase-js-sdk (#8892)
• firestore: typescript - firestore types now match modular firebase-js-sdk - see migration guide

Please see https://rnfirebase.io/migrating-to-v24 for a guide on updating your types if you were using the previous firestore typescript types.

In general everything should behave the same as v23 but the typescript types have changed. It is our hope you as a developer can adopt these changes easily and your app works exactly the same.

It is always our goal to be a drop-in replacement for firebase-js-sdk, type for type, API for API. In general all firestore types should now be the same as the firestore modular types from firebase-js-sdk

• functions: you must enable new architecture to use the functions module All modules will be converted to new architecture soon, old architecture support is deprecated in general for react-native-firebase

Features

• firestore: Support for Firestore pipelines API (#8931) (54021c4)
• firestore: implement withConverter (#8744) (13d6bb3)
• ai: CodeExecutionTool types for allowing model to run code (#8866) (81a0f19)

... (truncated)

Changelog

Sourced from @​react-native-firebase/messaging's changelog.

25.1.0 (2026-06-25)

Features

• firestore: variable() and arrayFilter() API features for pipelines (#9017) (cbe2593)

Bug Fixes

• auth, perf: correctly export expo config plugin, add test for same (dfb8126)

25.0.1 (2026-06-23)

Bug Fixes

• auth: export revokeToken in modular API for Sign in with Apple (a05fa66), closes #9070

25.0.0 (2026-06-23)

⚠ BREAKING CHANGES

• auth: migrate to TypeScript and bring auth closer in alignment with firebase-js-sdk API (#8991)
• messaging: deprecate permissions APIs, use react-native-permissions or expo-notifications (#9053)
• installations: installations modular types now match firebase-js-sdk

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Installations:

changed modular getInstallations() to return the firebase-js-sdk-style Installations type, which only exposes app; TypeScript consumers should use the modular helpers getId(installations), getToken(installations), and deleteInstallations(installations) instead of calling .getId(), .getToken(), or .delete() on the returned instance. changed modular deleteInstallations(installations) so the installations argument is required in the TypeScript surface, matching firebase-js-sdk. Code that previously relied on the old optional typing should pass getInstallations() explicitly. preserved the namespaced API surface: installations(), firebase.installations(), firebase.app().installations(), and FirebaseInstallationsTypes.Module remain available for compatibility, with deprecation annotations added. added explicit modular public types including Installations, IdChangeCallbackFn, and IdChangeUnsubscribeFn.

• perf: perf types now match firebase-js-sdk as closely as possible

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Performance:

• changed modular initializePerformance(app, settings) to return FirebasePerformance synchronously instead of Promise<Performance>, matching firebase-js-sdk; TypeScript consumers that call .then(...) on it will need to use the returned instance directly.
• aligned the modular FirebasePerformance type with firebase-js-sdk, so it no longer exposes older namespaced instance-style methods such as newTrace, startTrace, newHttpMetric, newScreenTrace, startScreenTrace, or setPerformanceCollectionEnabled in the modular typings; use trace(perf, name), httpMetric(perf, url, method), newScreenTrace(perf, name), startScreenTrace(perf, name), and the dataCollectionEnabled property instead.
• changed PerformanceSettings to the firebase-js-sdk shape, with optional dataCollectionEnabled and instrumentationEnabled.

... (truncated)

Commits

• e0a565d chore(release): release packages
• dfb8126 fix(auth, perf): correctly export expo config plugin, add test for same
• 93310ce chore(ci): grant pull-requests write to issue labeler workflow
• 34fce0e docs(firestore): add pipelines overview and SDK compatibility pages
• cbe2593 feat(firestore): variable() and arrayFilter() API features for pipelines...
• d3c4110 test(e2e): fix mocha-remote parse patch and macOS Metro bundle startup
• 11a2fa2 test(ios): e2e orchestration flake mitigation
• 1af1f3b test(android): mitigate android emulator startup and orchestration stabiity f...
• 2381efb test(ci): add Android e2e resource monitor
• 8394a52 test(ios): add tart ephemeral e2e reproduction pipeline
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​react-native-firebase/messaging since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

---

Note

Medium Risk
Push notifications and Firebase native SDK versions are affected across a major RNFirebase jump (20→25); validate FCM on iOS/Android and reconcile the pinned Android firebase-messaging artifact with the new RNFirebase release.

Overview
Bumps @react-native-firebase/app and @react-native-firebase/messaging from 20.5.0 to 25.1.0 in package.json, with the lockfile pulling firebase 12.15.0 (from 10.x) and a large refresh of @firebase/* packages. undici moves to 6.27.0, including security fixes carried in via the Firebase dependency tree.

There are no app source changes in this diff—only dependency versions. Reviewers should plan for native rebuilds (pod install, clean Android builds) and RNFirebase v24/v25 migration notes (TypeScript surface changes, deprecated messaging permission APIs in v25). Android still declares a manual firebase-messaging:23.0.0 in android/app/build.gradle with a comment to keep it aligned with react-native-firebase; that pin was not updated here and may need a follow-up after verifying the version RNFirebase 25 expects.

^{Reviewed by Cursor Bugbot for commit e5e06ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​react-native-firebase/​app@​20.5.0 ⏵ 25.1.0			+1
	@​react-native-firebase/​messaging@​20.5.0 ⏵ 25.1.0			+1

View full report