Bump undici, @react-native-firebase/app and @react-native-firebase/messaging

[dependabot]

Bumps undici to 6.27.0 and updates ancestor dependencies undici, @react-native-firebase/app and @react-native-firebase/messaging. These dependencies need to be updated together.

Updates undici from 6.21.3 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	b7f252e7
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	25efa447
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	25efa447
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	f4c31d60

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

---

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

• 551138c Bumped v6.27.0 (#5431)
• b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
• 25efa44 fix(cookies): preserve values and parse SameSite strictly
• f4c31d6 fix: guard idle socket validation to skip fresh sockets (#5400)
• 768beac Bumped v6.26.0 (#5323)
• 7917b25 fix: validate EOF for chunked h1 responses (#5308)
• 3420499 Bumped v6.25.0 (#5029)
• d7a1e55 feat: add configurable maxPayloadSize for WebSocket (#4955)
• a9d1848 Do not mark v6.x releases as latest
• 0126586 Ignore local agent configuration files
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Updates @react-native-firebase/app from 20.5.0 to 25.1.0

Release notes

Sourced from @​react-native-firebase/app's releases.

v24.1.1

Bug Fixes

• ios: revert to firebase-ios-sdk 12.10.0 to avoid startup crash (b97bc26)

v24.1.0

Features

• analytics: add Expo config plugin for withoutAdIdSupport (#8969) (5af7a6a)
• analytics: add support for googleAppMeasurementOnDeviceConversion in iOS Expo plugin (#9014) (a7a5125)
• firestore: add 'source' option to enable local cache firestore listeners (e3ce410)

Bug Fixes

• analytics: cast item INDEX param to integer (915dc8a)
• analytics: coerce all number params from js double to native integral (760ddd2)
• analytics: success param type now boolean - never worked before, now works (7e122b2)
• android: catch RejectedExecutionException on executor-backed Tasks (375ade9)
• database, android: remove RTDB listeners before shutting down executors (25ed605)
• docs: workflow to generate+publish API docs, call same on publish (8222a96)
• firebase-android-sdk 34.14.0, firebase-ios-sdk 12.11.0, firebase-js-sdk 12.14.0 (65bbe94)
• firestore, android: catch RejectedExecutionException in sendOnSnapshotEvent (602d7ad)
• firestore: restore generic root type exports for DocumentSnapshot, Transaction, and WriteBatch (#8997) (9809622)

v24.0.0

⚠ BREAKING CHANGES

• firestore: migrate to TypeScript and match firebase-js-sdk (#8892)
• firestore: typescript - firestore types now match modular firebase-js-sdk - see migration guide

Please see https://rnfirebase.io/migrating-to-v24 for a guide on updating your types if you were using the previous firestore typescript types.

In general everything should behave the same as v23 but the typescript types have changed. It is our hope you as a developer can adopt these changes easily and your app works exactly the same.

It is always our goal to be a drop-in replacement for firebase-js-sdk, type for type, API for API. In general all firestore types should now be the same as the firestore modular types from firebase-js-sdk

• functions: you must enable new architecture to use the functions module All modules will be converted to new architecture soon, old architecture support is deprecated in general for react-native-firebase

Features

• firestore: Support for Firestore pipelines API (#8931) (54021c4)
• firestore: implement withConverter (#8744) (13d6bb3)
• ai: CodeExecutionTool types for allowing model to run code (#8866) (81a0f19)

... (truncated)

Changelog

Sourced from @​react-native-firebase/app's changelog.

25.1.0 (2026-06-25)

Features

• firestore: variable() and arrayFilter() API features for pipelines (#9017) (cbe2593)

Bug Fixes

• auth, perf: correctly export expo config plugin, add test for same (dfb8126)

25.0.1 (2026-06-23)

Bug Fixes

• auth: export revokeToken in modular API for Sign in with Apple (a05fa66), closes #9070

25.0.0 (2026-06-23)

⚠ BREAKING CHANGES

• auth: migrate to TypeScript and bring auth closer in alignment with firebase-js-sdk API (#8991)
• messaging: deprecate permissions APIs, use react-native-permissions or expo-notifications (#9053)
• installations: installations modular types now match firebase-js-sdk

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Installations:

changed modular getInstallations() to return the firebase-js-sdk-style Installations type, which only exposes app; TypeScript consumers should use the modular helpers getId(installations), getToken(installations), and deleteInstallations(installations) instead of calling .getId(), .getToken(), or .delete() on the returned instance. changed modular deleteInstallations(installations) so the installations argument is required in the TypeScript surface, matching firebase-js-sdk. Code that previously relied on the old optional typing should pass getInstallations() explicitly. preserved the namespaced API surface: installations(), firebase.installations(), firebase.app().installations(), and FirebaseInstallationsTypes.Module remain available for compatibility, with deprecation annotations added. added explicit modular public types including Installations, IdChangeCallbackFn, and IdChangeUnsubscribeFn.

• perf: perf types now match firebase-js-sdk as closely as possible

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Performance:

• changed modular initializePerformance(app, settings) to return FirebasePerformance synchronously instead of Promise<Performance>, matching firebase-js-sdk; TypeScript consumers that call .then(...) on it will need to use the returned instance directly.
• aligned the modular FirebasePerformance type with firebase-js-sdk, so it no longer exposes older namespaced instance-style methods such as newTrace, startTrace, newHttpMetric, newScreenTrace, startScreenTrace, or setPerformanceCollectionEnabled in the modular typings; use trace(perf, name), httpMetric(perf, url, method), newScreenTrace(perf, name), startScreenTrace(perf, name), and the dataCollectionEnabled property instead.
• changed PerformanceSettings to the firebase-js-sdk shape, with optional dataCollectionEnabled and instrumentationEnabled.

... (truncated)

Commits

• e0a565d chore(release): release packages
• dfb8126 fix(auth, perf): correctly export expo config plugin, add test for same
• 93310ce chore(ci): grant pull-requests write to issue labeler workflow
• 34fce0e docs(firestore): add pipelines overview and SDK compatibility pages
• cbe2593 feat(firestore): variable() and arrayFilter() API features for pipelines...
• d3c4110 test(e2e): fix mocha-remote parse patch and macOS Metro bundle startup
• 11a2fa2 test(ios): e2e orchestration flake mitigation
• 1af1f3b test(android): mitigate android emulator startup and orchestration stabiity f...
• 2381efb test(ci): add Android e2e resource monitor
• 8394a52 test(ios): add tart ephemeral e2e reproduction pipeline
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​react-native-firebase/app since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @react-native-firebase/messaging from 20.5.0 to 25.1.0

Release notes

Sourced from @​react-native-firebase/messaging's releases.

v24.1.1

Bug Fixes

• ios: revert to firebase-ios-sdk 12.10.0 to avoid startup crash (b97bc26)

v24.1.0

Features

• analytics: add Expo config plugin for withoutAdIdSupport (#8969) (5af7a6a)
• analytics: add support for googleAppMeasurementOnDeviceConversion in iOS Expo plugin (#9014) (a7a5125)
• firestore: add 'source' option to enable local cache firestore listeners (e3ce410)

Bug Fixes

• analytics: cast item INDEX param to integer (915dc8a)
• analytics: coerce all number params from js double to native integral (760ddd2)
• analytics: success param type now boolean - never worked before, now works (7e122b2)
• android: catch RejectedExecutionException on executor-backed Tasks (375ade9)
• database, android: remove RTDB listeners before shutting down executors (25ed605)
• docs: workflow to generate+publish API docs, call same on publish (8222a96)
• firebase-android-sdk 34.14.0, firebase-ios-sdk 12.11.0, firebase-js-sdk 12.14.0 (65bbe94)
• firestore, android: catch RejectedExecutionException in sendOnSnapshotEvent (602d7ad)
• firestore: restore generic root type exports for DocumentSnapshot, Transaction, and WriteBatch (#8997) (9809622)

v24.0.0

⚠ BREAKING CHANGES

• firestore: migrate to TypeScript and match firebase-js-sdk (#8892)
• firestore: typescript - firestore types now match modular firebase-js-sdk - see migration guide

Please see https://rnfirebase.io/migrating-to-v24 for a guide on updating your types if you were using the previous firestore typescript types.

In general everything should behave the same as v23 but the typescript types have changed. It is our hope you as a developer can adopt these changes easily and your app works exactly the same.

It is always our goal to be a drop-in replacement for firebase-js-sdk, type for type, API for API. In general all firestore types should now be the same as the firestore modular types from firebase-js-sdk

• functions: you must enable new architecture to use the functions module All modules will be converted to new architecture soon, old architecture support is deprecated in general for react-native-firebase

Features

• firestore: Support for Firestore pipelines API (#8931) (54021c4)
• firestore: implement withConverter (#8744) (13d6bb3)
• ai: CodeExecutionTool types for allowing model to run code (#8866) (81a0f19)

... (truncated)

Changelog

Sourced from @​react-native-firebase/messaging's changelog.

25.1.0 (2026-06-25)

Features

• firestore: variable() and arrayFilter() API features for pipelines (#9017) (cbe2593)

Bug Fixes

• auth, perf: correctly export expo config plugin, add test for same (dfb8126)

25.0.1 (2026-06-23)

Bug Fixes

• auth: export revokeToken in modular API for Sign in with Apple (a05fa66), closes #9070

25.0.0 (2026-06-23)

⚠ BREAKING CHANGES

• auth: migrate to TypeScript and bring auth closer in alignment with firebase-js-sdk API (#8991)
• messaging: deprecate permissions APIs, use react-native-permissions or expo-notifications (#9053)
• installations: installations modular types now match firebase-js-sdk

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Installations:

changed modular getInstallations() to return the firebase-js-sdk-style Installations type, which only exposes app; TypeScript consumers should use the modular helpers getId(installations), getToken(installations), and deleteInstallations(installations) instead of calling .getId(), .getToken(), or .delete() on the returned instance. changed modular deleteInstallations(installations) so the installations argument is required in the TypeScript surface, matching firebase-js-sdk. Code that previously relied on the old optional typing should pass getInstallations() explicitly. preserved the namespaced API surface: installations(), firebase.installations(), firebase.app().installations(), and FirebaseInstallationsTypes.Module remain available for compatibility, with deprecation annotations added. added explicit modular public types including Installations, IdChangeCallbackFn, and IdChangeUnsubscribeFn.

• perf: perf types now match firebase-js-sdk as closely as possible

Please see https://rnfirebase.io/migrating-to-v25 for help migrating if needed.

react-native-firebase has a goal to be a drop-in replacement for firebase-js-sdk, with native extensions and performance. It has always worked that way at the javascript level but the typescript types have been divergent.

We are fixing that as we refactor to typescript. Please bear with us as we get closer to our goal of react-native-firebase matching firebase-js-sdk both in functionality where possible, but also in exact typescript typing.

Specifics for Performance:

• changed modular initializePerformance(app, settings) to return FirebasePerformance synchronously instead of Promise<Performance>, matching firebase-js-sdk; TypeScript consumers that call .then(...) on it will need to use the returned instance directly.
• aligned the modular FirebasePerformance type with firebase-js-sdk, so it no longer exposes older namespaced instance-style methods such as newTrace, startTrace, newHttpMetric, newScreenTrace, startScreenTrace, or setPerformanceCollectionEnabled in the modular typings; use trace(perf, name), httpMetric(perf, url, method), newScreenTrace(perf, name), startScreenTrace(perf, name), and the dataCollectionEnabled property instead.
• changed PerformanceSettings to the firebase-js-sdk shape, with optional dataCollectionEnabled and instrumentationEnabled.

... (truncated)

Commits

• e0a565d chore(release): release packages
• dfb8126 fix(auth, perf): correctly export expo config plugin, add test for same
• 93310ce chore(ci): grant pull-requests write to issue labeler workflow
• 34fce0e docs(firestore): add pipelines overview and SDK compatibility pages
• cbe2593 feat(firestore): variable() and arrayFilter() API features for pipelines...
• d3c4110 test(e2e): fix mocha-remote parse patch and macOS Metro bundle startup
• 11a2fa2 test(ios): e2e orchestration flake mitigation
• 1af1f3b test(android): mitigate android emulator startup and orchestration stabiity f...
• 2381efb test(ci): add Android e2e resource monitor
• 8394a52 test(ios): add tart ephemeral e2e reproduction pipeline
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​react-native-firebase/messaging since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

---

Note

Medium Risk
Major react-native-firebase upgrade affects native push/Firebase initialization without accompanying app or Gradle/Podfile changes in the diff; undici security bump is lower risk but bundled with a wide transitive Firebase tree change.

Overview
Dependency-only update: @react-native-firebase/app and @react-native-firebase/messaging move from 20.5.0 to 25.1.0 in package.json, with the lockfile pulling firebase 12.15.0 and a full refresh of @firebase/* packages (including new @firebase/ai and @firebase/data-connect). @react-native-firebase/app no longer depends on superstruct; transitive undici is bumped to 6.27.0 (security fixes).

There are no application source changes in this diff—push usage in the app (getToken, foreground/background handlers) stays on the existing namespaced messaging() API. Reviewers should still treat v20 → v25 as a large RN Firebase jump (v24/v25 migration guides cover TypeScript and modular API shifts, and v25 deprecates messaging permission helpers in favor of react-native-permissions / Expo—not used in app code today). After merge, expect pod install / native rebuilds and confirm Android Firebase artifacts stay aligned with the new SDK (e.g. the pinned firebase-messaging version in android/app/build.gradle is outside this PR).

^{Reviewed by Cursor Bugbot for commit e6f2dff. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​react-native-firebase/​app@​20.5.0 ⏵ 25.1.0			+1
	@​react-native-firebase/​messaging@​20.5.0 ⏵ 25.1.0			+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 2637605. Configure here.}

[cursor]

Native Firebase versions unsynced

High Severity

This change moves @react-native-firebase/app and @react-native-firebase/messaging to 25.1.0 in npm only. The repo still pins older native Firebase (for example ios/Podfile.lock at RNFB 20.5.0 and Android firebase-messaging:23.0.0, which the Gradle comment says must stay aligned with react-native-firebase). That mismatch can cause iOS/Android build failures or broken FCM after npm ci if pods or Gradle aren’t fully refreshed.

 

^{Reviewed by Cursor Bugbot for commit 2637605. Configure here.}