8.2.0

• Added support for Unicode characters in email addresses.

App Check

• Added replay-protection verification for App Check tokens via verifyTokenWithReplayProtection(). The response now includes alreadyConsumed when replay protection is used.
• Added transitional contract Kreait\Firebase\Contract\AppCheckWithReplayProtection. This was introduced to preserve backwards compatibility by avoiding a signature change to Kreait\Firebase\Contract\AppCheck::verifyToken() in the current major release.
• Added dedicated exception Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckReplayProtection for replay-protection verification failures. It extends Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckToken for backwards compatibility.

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.24.1

Added support for firebase/php-jwt:^7.0.2 to remediate the vulnerabilities PKSA-y2cr-5h3j-g3ys and CVE-2025-4659.

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

8.1.0

Added support for firebase/php-jwt:^7.0.2

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

8.0.0

Security improvements

• Added #[SensitiveParameter] attributes to methods handling sensitive data (passwords, tokens, private keys)
  to prevent them from appearing in stack traces and error logs.

Breaking changes

• The SDK supports only actively supported PHP versions. As a result, support for PHP < 8.3 has been dropped;
  supported versions are 8.3, 8.4, and 8.5.
• Firebase Dynamic Links was shut down on August 25th, 2025
  and has been removed from the SDK.
• Deprecated classes, methods and class constants have been removed.
• Method arguments are now fully type-hinted
• Type declarations have been simplified to reduce runtime overhead (e.g., Stringable|string to string).
• The transitional Kreait\Firebase\Contract\Transitional\FederatedUserFetcher::getUserByProviderUid() method
  has been moved into the Kreait\Firebase\Contract\Auth interface
• Realtime Database objects considered value objects have been made final and readonly
• psr/log has been moved from runtime dependencies to development dependencies
• Kreait\Firebase\Contract\Messaging::BATCH_MESSAGE_LIMIT constant has been removed
• Exception codes are no longer preserved when wrapping exceptions
• Kreait\Firebase\Messaging\CloudMessage builder methods have been renamed to follow the with* pattern:
  toToken() -> withToken(), toTopic() -> withTopic(), toCondition() -> withCondition().
  The old methods are deprecated but still available as aliases.

See UPGRADE-8.0 for more details on the changes between 7.x and 8.0.

7.x Changelog

https://github.com/kreait/firebase-php/blob/7.24.0/CHANGELOG.md

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.24.0

Changed

• Realtime Database references are now validated by the API instead of locally. Validation rules can change at any time, and the SDK can only adapt to changes in the API. While local checks could prevent obviously invalid paths, they'd also require an SDK update whenever Firebase loosens a rule. Developers can be trusted not to use invalid paths 😅.
• Removed the #[SensitiveParameter] attribute again, because it's supported by PHP 8.1 itself, but not in combination with Valinor. (#1034)

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.23.0

Require cuyz/valinor:^2.2.1 for better mapping.

7.22.0

Added

• Added support for PHP 8.5

Changed

• The project now features a custom logo (I came up with it myself, and took the wise decision to not look up if there's something similar already)
• Refined README for improved clarity, removed outdated documentation sections, and streamlined project support messaging with a more positive call to action
• Documentation now uses the modern Furo theme, providing a cleaner and more pleasant reading experience

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.21.2

Fixed

• Re-added the #[SensitiveParameter] attribute because, while it's not supported in PHP 8.1, it can still be used if placed in a standalone line above the variable or property.
• Re-added support for JSON files with any file extension
• With the introduction of Valinor, Service Account credentials were required to have more fields than necessary to work with the SDK, although it only needs the client email, private key, and project ID.

7.21.1

Fixes

Removed the #[SensitiveParameter] attribute because it's not supported in PHP 8.1.

7.21.0

Changed

This release introduces Valinor for type-safe object mapping. The first application is mapping a given service account file, JSON, or array to the newly added internal ServiceAccount class, with more to follow in future releases.