Firebase Php Laravel Package

• Added support for guzzlehttp/guzzle:^8.0, guzzlehttp/psr7:^3.0 and guzzlehttp/promises:^3.0.
• Updated the firebase/php-jwt constraint to ^7.0.2. Although CVE-2025-45769 is rated as low severity, it has been disputed on the basis that applications, rather than the library, are responsible for choosing appropriate key lengths. Nevertheless, a review of the library's most-downloaded dependents showed that most already support version 7.x.

Security improvements

• Restricted Realtime Database URLs to Firebase-owned hosts and reject non-root URLs with embedded paths, query strings, or fragments while preserving emulator support. Related OWASP Top 10:2025 entry: A02 Security Misconfiguration.
• Updated dependency mtdowling/jmespath.php to 2.9.2 to address CVE-2026-54133

• Added support for Unicode characters in email addresses.

App Check

• Added replay-protection verification for App Check tokens via verifyTokenWithReplayProtection(). The response now includes alreadyConsumed when replay protection is used.
• Added transitional contract Kreait\Firebase\Contract\AppCheckWithReplayProtection. This was introduced to preserve backwards compatibility by avoiding a signature change to Kreait\Firebase\Contract\AppCheck::verifyToken() in the current major release.
• Added dedicated exception Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckReplayProtection for replay-protection verification failures. It extends Kreait\Firebase\Exception\AppCheck\FailedToVerifyAppCheckToken for backwards compatibility.

• Added support for firebase/php-jwt:^7.0.2

Security improvements

• Added #[SensitiveParameter] attributes to methods handling sensitive data (passwords, tokens, private keys) to prevent them from appearing in stack traces and error logs.

Breaking changes

• The SDK supports only actively supported PHP versions. As a result, support for PHP < 8.3 has been dropped; supported versions are 8.3, 8.4, and 8.5.
• Firebase Dynamic Links was shut down on August 25th, 2025 and has been removed from the SDK.
• Deprecated classes, methods and class constants have been removed.
• Method arguments are now fully type-hinted
• Type declarations have been simplified to reduce runtime overhead (e.g., Stringable|string to string).
• The transitional Kreait\Firebase\Contract\Transitional\FederatedUserFetcher::getUserByProviderUid() method has been moved into the Kreait\Firebase\Contract\Auth interface
• Realtime Database objects considered value objects have been made final and readonly
• psr/log has been moved from runtime dependencies to development dependencies
• Kreait\Firebase\Contract\Messaging::BATCH_MESSAGE_LIMIT constant has been removed
• Exception codes are no longer preserved when wrapping exceptions
• Kreait\Firebase\Messaging\CloudMessage builder methods have been renamed to follow the with* pattern: toToken() -> withToken(), toTopic() -> withTopic(), toCondition() -> withCondition(). The old methods are deprecated but still available as aliases.

See UPGRADE-8.0 for more details on the changes between 7.x and 8.0.

• FCM 403 PERMISSION_DENIED responses with the error code SENDER_ID_MISMATCH are now converted to a dedicated Kreait\Firebase\Exception\Messaging\SenderIdMismatch exception instead of the more generic AuthenticationError.

https://github.com/beste/firebase-php/blob/7.24.0/CHANGELOG.md