Sourcemap Explorer
Stack · npm package

firebase

Firebase JavaScript library for web and Node.js

latest 12.17.1· Apache-2.0· 4,209 versions publishedView on npm

About

Firebase JavaScript library for web and Node.js

authenticationdatabaseFirebasefirebaserealtimestorageperformanceremote-config

What detecting firebase tells you about a site

firebase in the client bundle tells you the app leans on Google's BaaS for some mix of auth, Firestore/Realtime Database, storage, analytics or messaging — often with no traditional backend at all. Its presence signals a serverless architecture where the client talks directly to Firebase services.

Why the exact firebase version matters

Firebase v9 introduced the modular, tree-shakeable SDK (`import { getAuth }`) that dramatically cut bundle size versus the v8 namespaced API. The exact version tells you whether the app is on the modern modular SDK or the heavier legacy one — a real performance signal.

firebase in a real-world stack

When you find firebase in a bundle, it rarely travels alone. Individual @firebase/* modules (app, auth, firestore) pulled in by the umbrella package.

Quick facts

Latest version12.17.1
LicenseApache-2.0
AuthorFirebase
Installnpm install firebase
Direct dependencies28

What firebase pulls in

firebase declares 28 direct dependencies — each one also rides into any bundle that ships firebase, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .

@firebase/ai@firebase/app@firebase/auth@firebase/util@firebase/storage@firebase/database@firebase/analytics@firebase/app-check@firebase/app-types@firebase/firestore@firebase/functions@firebase/messaging@firebase/app-compat@firebase/auth-compat@firebase/performance@firebase/data-connect@firebase/installations@firebase/remote-config@firebase/storage-compat@firebase/database-compat@firebase/analytics-compat@firebase/app-check-compat@firebase/firestore-compat@firebase/functions-compat@firebase/messaging-compat@firebase/performance-compat@firebase/installations-compat@firebase/remote-config-compat

How Sourcemap Explorer detects firebase

firebase ships as v12.17.1, published 2026-08-04 and carries 28 direct dependencies, 4,209 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when firebase rides inside a deployed bundle — here is how the detection works.

We catch firebase from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/firebase/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

  1. 1

    Confirm the site exposes sourcemaps

    In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `firebase` paths live.

  2. 2

    Find the package in the bundle

    Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/firebase/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/firebase/package.json` gives you the exact installed version.

  3. 3

    Read the version directly from package.json

    Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/firebase/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of firebase

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the firebase version a site actually ships against the ecosystem.

Major
First release
Date
v12
12.0.0
2025-07-17
v11
11.0.0
2024-10-21
v10
10.0.0
2023-07-07
v9
9.0.0
2021-08-25
v8
8.0.0
2020-10-26
v7
7.0.0
2019-09-25

Recent security advisories for firebase

The 1 most recent advisories affecting some versions of firebase, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

  1. MODERATECVE-2024-11023· 2024-11-18

    Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

Recent versions

Version
Released
12.17.1
2026-08-04
12.17.0
2026-07-30
12.16.0
2026-07-09
12.15.0
2026-06-16
12.14.0
2026-05-28
12.13.0
2026-05-07
12.12.1
2026-04-20
12.12.0
2026-04-09

firebase README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

Firebase JavaScript SDK

Build Status Version Coverage Status

The Firebase JavaScript SDK implements the client-side libraries used by applications using Firebase services. This SDK is distributed via:

To get started using Firebase, see Add Firebase to your JavaScript Project.

Release Notes

Upgrade to Version 9

Version 9 has a redesigned API that supports tree-shaking. Read the Upgrade Guide to learn more.

Supported Environments

Please see Environment Support.

SDK Dev Workflow

Prerequisites

Node.js

Before you can start working on the Firebase JS SDK, you need to have Node.js installed on your machine. As of July 17th, 2026 the team has been testing with Node.js version 20.19.0, but the required version of Node.js may change as we update our dependencies.

To download Node.js visit https://nodejs.org/en/download/.

NOTE: You can use a tool like NVM or N to install and manage multiple node versions

Yarn

In addition to Node.js we use yarn to facilitate multi package development.

To install yarn follow the instructions listed on their website: https://yarnpkg.com/en/docs/install

This repo currently supports building with yarn 1.x. For instance, after installing yarn, run

$ yarn set version 1.22.11
Java

The closure compiler requires a modern Java installation. Java 11+ should be installed: https://www.oracle.com/java/technologies/downloads/#java11

Verify Prerequisites

You can verify your setup by running the following commands in your terminal:

$ node -v
$ yarn -v
$ java -version

Your node version should be 20.19.0 or greater, your yarn version should be between 1.0.0 and 1.22.11, and your java version should be 11.0 or greater.

NOTE: We will update the documentation as new versions are required, however for continuing development on the SDK, staying up to date on the stable versions of these packages is advised

Install Dependencies

Once you have Node.js and yarn installed on your machine and have validated that you are running the proper version, you can set up the development environment by running the following at the root of the SDK:

$ yarn

Once you have installed all the dependencies, you can build the entire SDK by running the following command the root of the SDK:

$ yarn build

Testing the SDK

Test Setup

A production project is required to test the Firebase JS SDK. You can create a new project by visiting the Firebase Console.

Web App Setup

Visit the "Project Overview" and select "Add app" under your project name. Register the app with a nickname and click through the remaining steps. Without performing this step, you will encounter the error in the test setup:

FirebaseError: There are no WEB apps associated with this Firebase project
Firestore Database Setup

Visit the "Firestore Database" section of the console and create a Cloud Firestore database. When prompted to select the set of initial security rules, select any option (e.g. "Start in Production Mode") since these permission settings will be overwritten below.

Realtime Database Setup

Visit the "Realtime Database" section of the console and create a realtime database. When prompted to select the set of initial security rules, select any option (e.g. "Start in Locked Mode") since these permission settings will be overwritten below.

Storage Setup

Visit the "Storage" section of the console and create a storage bucket. In order to run the tests, you will need to update your bucket's CORS rules.

  1. Create a new file called cors.json with the contents:
[
    {
        "origin": ["http://localhost:8089"],
        "method": ["GET"],
        "maxAgeSeconds": 3600
    }
]
  1. Install gsutil from https://cloud.google.com/storage/docs/gsutil_install
  2. You will need to login if this is your first time using gsutil. Run gcloud auth login and follow the instructions to login.
  3. Run gcloud storage buckets update gs://<your-cloud-storage-bucket> --cors-file=cors.json

For more information, visit https://firebase.google.com/docs/storage/web/download-files#cors_configuration

Then, make sure you have anonymous sign-in provider enabled:

Authentication Support

Visit the authentication config in your project and enable the Anonymous sign-in provider to complete your project config.

Automated Setup

The tests need to be configured to use the Firebase production project that you created in the "Test Setup" section above. To do this, run the yarn test:setup command, as follows:

# Select the Firebase project via the text-based UI. This will run tools/config.js
# and deploy from config/ to your Firebase project.
$ yarn test:setup

# Specify the Firebase project via the command-line arguments.
$ yarn test:setup --projectId=<test_firebase_project_id>

If you see an error like

HTTP Error: 404, Project '<test_firebase_project_id>' does not exist.

then make sure that you have created the database as specified in the "Firestore Database Setup" section above.

Running the tests

Each of the directories in the integration directory as well as the packages directory have their own test suites. You will need to build the SDK before running tests. Test suites can be run all together by running the following command at the root of the package:

$ yarn test

In addition, you can run any of the tests individually by running yarn test in an individual package directory.

Building the SDK

Introduction

The Firebase JS SDK is built with a series of individual packages that are all contained in this repository. Development is coordinated via yarn workspaces and Lerna (a monorepo management tool).

Each package in the packages directory, constitute a piece of our implementation. The SDK is built via a combination of all of these packages which are published under the firebase scope on NPM.

Testing the SDK Locally

Please be sure your product's package has been built before proceeding any further. (If you haven't built this repo before, make sure to run yarn build at the root) In order to manually test your SDK changes locally, you must use yarn link:

$ cd packages/firebase
$ yarn link # initialize the linking to the other folder
$ cd ../<my-product> # Example: $ cd ../firestore
$ yarn link # link your product to make it available elsewhere
$ cd <my-test-app-dir> # cd into your personal project directory
$ yarn link firebase @firebase/<my-product> # tell yarn to use the locally built firebase SDK instead

This will create a symlink and point your <my-test-app-dir> to the locally built version of the firebase SDK.

Helper Scripts

Each package in the packages directory exposes a dev script. This script will set up a watcher for development on the individual piece of the SDK. In addition, there is a top level dev script that can be run to start all of the watch tasks as well as a sandbox server.

You can run the dev script by running the following at the root of the package:

$ yarn dev

Prepush Hooks

As part of this repo, we use the NPM package husky to implement git hooks. We leverage the prepush hook to do two things:

  • Automated code styling (using prettier)
  • Automated LICENSE header insertion

Contributing

See Contributing for more information on contributing to the Firebase JavaScript SDK.

FAQ

What is firebase used for?

Firebase JavaScript library for web and Node.js

How can I tell if a website is using firebase?

Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `firebase` from two complementary signals: `node_modules/firebase/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.

How do I find out which version of firebase a website is running?

Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `firebase/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/firebase/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 12.17.1, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.

What is the latest version of firebase?

12.17.1, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.

Is firebase actively maintained?

Very actively maintained — the last release shipped within the past three months. The last published release was 2026-08-04. Source code: https://github.com/firebase/firebase-js-sdk.

Does firebase have known security vulnerabilities?

1 recent advisory affecting some versions of firebase is listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.

Where can I read more?

Project homepage: https://firebase.google.com/. Source code: https://github.com/firebase/firebase-js-sdk. Published on npm: https://www.npmjs.com/package/firebase. Licensed as Apache-2.0.

Keep reading on Sourcemap Explorer

Practical guides

Detected by Sourcemap Explorer

When a bundle ships sourcemaps, we read the embedded package.json for firebase and report the precise version (the registry's latest is v12.17.1, published 2026-08-04; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.

Install free on Chrome