firebase
Firebase JavaScript library for web and Node.js
About
Firebase JavaScript library for web and Node.js
What detecting firebase tells you about a site
firebase in the client bundle tells you the app leans on Google's BaaS for some mix of auth, Firestore/Realtime Database, storage, analytics or messaging — often with no traditional backend at all. Its presence signals a serverless architecture where the client talks directly to Firebase services.
Why the exact firebase version matters
Firebase v9 introduced the modular, tree-shakeable SDK (`import { getAuth }`) that dramatically cut bundle size versus the v8 namespaced API. The exact version tells you whether the app is on the modern modular SDK or the heavier legacy one — a real performance signal.
firebase in a real-world stack
When you find firebase in a bundle, it rarely travels alone. Individual @firebase/* modules (app, auth, firestore) pulled in by the umbrella package.
Quick facts
npm install firebaseWhat firebase pulls in
firebase declares 28 direct dependencies — each one also rides into any bundle that ships firebase, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .
How Sourcemap Explorer detects firebase
firebase ships as v12.17.1, published 2026-08-04 and carries 28 direct dependencies, 4,209 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when firebase rides inside a deployed bundle — here is how the detection works.
We catch firebase from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/firebase/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.
- 1
Confirm the site exposes sourcemaps
In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `firebase` paths live.
- 2
Find the package in the bundle
Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/firebase/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/firebase/package.json` gives you the exact installed version.
- 3
Read the version directly from package.json
Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/firebase/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.
Major releases of firebase
When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the firebase version a site actually ships against the ecosystem.
Recent security advisories for firebase
The 1 most recent advisories affecting some versions of firebase, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
Recent versions
firebase README
Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.
Firebase JavaScript SDK
The Firebase JavaScript SDK implements the client-side libraries used by applications using Firebase services. This SDK is distributed via:
To get started using Firebase, see Add Firebase to your JavaScript Project.
Upgrade to Version 9
Version 9 has a redesigned API that supports tree-shaking. Read the Upgrade Guide to learn more.
Supported Environments
Please see Environment Support.
SDK Dev Workflow
Prerequisites
Node.js
Before you can start working on the Firebase JS SDK, you need to have Node.js
installed on your machine. As of July 17th, 2026 the team has been testing with Node.js version
20.19.0, but the required version of Node.js may change as we update our dependencies.
To download Node.js visit https://nodejs.org/en/download/.
NOTE: You can use a tool like NVM
or N to install and manage multiple node versions
Yarn
In addition to Node.js we use yarn to facilitate multi package development.
To install yarn follow the instructions listed on their website:
https://yarnpkg.com/en/docs/install
This repo currently supports building with yarn 1.x. For instance, after installing yarn, run
$ yarn set version 1.22.11
Java
The closure compiler requires a modern Java installation. Java 11+ should be installed: https://www.oracle.com/java/technologies/downloads/#java11
Verify Prerequisites
You can verify your setup by running the following commands in your terminal:
$ node -v
$ yarn -v
$ java -version
Your node version should be 20.19.0 or greater, your yarn version should
be between 1.0.0 and 1.22.11, and your java version should be 11.0 or greater.
NOTE: We will update the documentation as new versions are required, however for continuing development on the SDK, staying up to date on the stable versions of these packages is advised
Install Dependencies
Once you have Node.js and yarn installed on your machine and have validated
that you are running the proper version, you can set up the development environment
by running the following at the root of the SDK:
$ yarn
Once you have installed all the dependencies, you can build the entire SDK by running the following command the root of the SDK:
$ yarn build
Testing the SDK
Test Setup
A production project is required to test the Firebase JS SDK. You can create a new project by visiting the Firebase Console.
Web App Setup
Visit the "Project Overview" and select "Add app" under your project name. Register the app with a nickname and click through the remaining steps. Without performing this step, you will encounter the error in the test setup:
FirebaseError: There are no WEB apps associated with this Firebase project
Firestore Database Setup
Visit the "Firestore Database" section of the console and create a Cloud Firestore database. When prompted to select the set of initial security rules, select any option (e.g. "Start in Production Mode") since these permission settings will be overwritten below.
Realtime Database Setup
Visit the "Realtime Database" section of the console and create a realtime database. When prompted to select the set of initial security rules, select any option (e.g. "Start in Locked Mode") since these permission settings will be overwritten below.
Storage Setup
Visit the "Storage" section of the console and create a storage bucket. In order to run the tests, you will need to update your bucket's CORS rules.
- Create a new file called
cors.jsonwith the contents:
[
{
"origin": ["http://localhost:8089"],
"method": ["GET"],
"maxAgeSeconds": 3600
}
]
- Install
gsutilfrom https://cloud.google.com/storage/docs/gsutil_install - You will need to login if this is your first time using
gsutil. Rungcloud auth loginand follow the instructions to login. - Run
gcloud storage buckets update gs://<your-cloud-storage-bucket> --cors-file=cors.json
For more information, visit https://firebase.google.com/docs/storage/web/download-files#cors_configuration
Then, make sure you have anonymous sign-in provider enabled:
Authentication Support
Visit the authentication config in your project and enable the Anonymous
sign-in provider to complete your project config.
Automated Setup
The tests need to be configured to use the Firebase production project that you
created in the "Test Setup" section above. To do this, run the yarn test:setup
command, as follows:
# Select the Firebase project via the text-based UI. This will run tools/config.js
# and deploy from config/ to your Firebase project.
$ yarn test:setup
# Specify the Firebase project via the command-line arguments.
$ yarn test:setup --projectId=<test_firebase_project_id>
If you see an error like
HTTP Error: 404, Project '<test_firebase_project_id>' does not exist.
then make sure that you have created the database as specified in the "Firestore Database Setup" section above.
Running the tests
Each of the directories in the integration directory as well as the packages
directory have their own test suites. You will need to build the SDK before
running tests. Test suites can be run all together by running the following
command at the root of the package:
$ yarn test
In addition, you can run any of the tests individually by running yarn test in
an individual package directory.
Building the SDK
Introduction
The Firebase JS SDK is built with a series of individual packages that are all contained in this repository. Development is coordinated via yarn workspaces and Lerna (a monorepo management tool).
Each package in the packages directory, constitute a piece of our
implementation. The SDK is built via a combination of all of these packages
which are published under the firebase
scope on NPM.
Testing the SDK Locally
Please be sure your product's package has been built before proceeding any further. (If you haven't built this repo before, make sure to run yarn build at the root)
In order to manually test your SDK changes locally, you must use yarn link:
$ cd packages/firebase
$ yarn link # initialize the linking to the other folder
$ cd ../<my-product> # Example: $ cd ../firestore
$ yarn link # link your product to make it available elsewhere
$ cd <my-test-app-dir> # cd into your personal project directory
$ yarn link firebase @firebase/<my-product> # tell yarn to use the locally built firebase SDK instead
This will create a symlink and point your <my-test-app-dir> to the locally built version of the firebase SDK.
Helper Scripts
Each package in the packages directory exposes a dev script. This script
will set up a watcher for development on the individual piece of the SDK. In
addition, there is a top level dev script that can be run to start all of the
watch tasks as well as a sandbox server.
You can run the dev script by running the following at the root of the package:
$ yarn dev
Prepush Hooks
As part of this repo, we use the NPM package husky to
implement git hooks. We leverage the prepush hook to do two things:
- Automated code styling (using
prettier) - Automated LICENSE header insertion
Contributing
See Contributing for more information on contributing to the Firebase JavaScript SDK.
FAQ
What is firebase used for?
Firebase JavaScript library for web and Node.js
How can I tell if a website is using firebase?
Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `firebase` from two complementary signals: `node_modules/firebase/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.
How do I find out which version of firebase a website is running?
Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `firebase/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/firebase/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 12.17.1, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.
What is the latest version of firebase?
12.17.1, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.
Is firebase actively maintained?
Very actively maintained — the last release shipped within the past three months. The last published release was 2026-08-04. Source code: https://github.com/firebase/firebase-js-sdk.
Does firebase have known security vulnerabilities?
1 recent advisory affecting some versions of firebase is listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.
Where can I read more?
Project homepage: https://firebase.google.com/. Source code: https://github.com/firebase/firebase-js-sdk. Published on npm: https://www.npmjs.com/package/firebase. Licensed as Apache-2.0.
Keep reading on Sourcemap Explorer
Practical guides
Detected by Sourcemap Explorer
When a bundle ships sourcemaps, we read the embedded package.json for firebase and report the precise version (the registry's latest is v12.17.1, published 2026-08-04; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.