@react-native-firebase/app 26.3.2 → 26.4.0

package/CHANGELOG.md

@@ -3,6 +3,51 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [26.4.0](https://github.com/invertase/react-native-firebase/compare/v26.3.3...v26.4.0) (2026-09-05)
+
+### Features
+
+- **app:** add RNFBHandleMap for thread-safe handle registries ([d28edd5](https://github.com/invertase/react-native-firebase/commit/d28edd579281da523b626934e89a14dd38dd3ed8))
+
+### Bug Fixes
+
+- **app, android:** clear stale custom auth domains ([ccde348](https://github.com/invertase/react-native-firebase/commit/ccde3483511efd1c54bcc4676bd02893f28e9014))
+- **app, android:** discard tasks posted to shut-down transactional executors ([de98eaa](https://github.com/invertase/react-native-firebase/commit/de98eaa9ff0484eeb9e00ec99d5228067611a4f3))
+- **app, expo:** add missing Firebase imports ([7d6f19c](https://github.com/invertase/react-native-firebase/commit/7d6f19c5ba513c5880dd401e225ce19d550e27df))
+- **app, ios:** clear stale custom auth domains ([d747981](https://github.com/invertase/react-native-firebase/commit/d7479818e52f4b4df84bba53c53345942b80af85))
+- **app:** handle empty Android Firebase JSON ([5c48832](https://github.com/invertase/react-native-firebase/commit/5c48832f70a62c1061448a723f1e6a193e09c74a))
+- **app:** isolate native routing keys ([fd13a7a](https://github.com/invertase/react-native-firebase/commit/fd13a7adf84791ce1c1c4ce38a1728a86ae9c6c0))
+- **app:** make debug native proxies behavior-safe ([6caff3c](https://github.com/invertase/react-native-firebase/commit/6caff3cfc706133d132a2762b355c65979631555))
+- **app:** parse data URL payloads completely ([eb5d54e](https://github.com/invertase/react-native-firebase/commit/eb5d54e8bdbd6748e6c024b26f19bf63b764d5bb))
+- **app:** preserve empty memory storage values ([41ac6bc](https://github.com/invertase/react-native-firebase/commit/41ac6bc2f1113a6412e23dd171752f6e5762c335))
+- **app:** preserve memidb event listeners ([c8648a6](https://github.com/invertase/react-native-firebase/commit/c8648a622533afd2f2a94ed36c3acd57c611a2b2))
+- **app:** preserve web Promise contracts ([36c586e](https://github.com/invertase/react-native-firebase/commit/36c586ea908a2faaebf1d40846497bde096a779c))
+- **app:** reject FileReader startup failures ([08319ae](https://github.com/invertase/react-native-firebase/commit/08319aed8191ab823a506b3166c18b8ef02853ac))
+- **app:** retain global logger configuration ([23aeb7b](https://github.com/invertase/react-native-firebase/commit/23aeb7bb5fe60f9421ba81b3f88c859dfd6d3d49))
+- **app:** support arbitrary web storage keys ([c2c9f42](https://github.com/invertase/react-native-firebase/commit/c2c9f4261464bf56c3e6521f54448dbe4649392f))
+- **app:** support prototype-named apps ([0ed7a0f](https://github.com/invertase/react-native-firebase/commit/0ed7a0fd7c99c894e2b94fd3de733dfa43096af2))
+- **auth, ios:** look up customAuthDomains with JS app name ([9873f61](https://github.com/invertase/react-native-firebase/commit/9873f618a972c3324ec05b9e30f5aaefa7ab163b))
+- **database:** use RNFBHandleMap for transaction and query maps ([8adba4c](https://github.com/invertase/react-native-firebase/commit/8adba4cb88dffec2442ea0fe37738d1080d0a185))
+- **messaging, android:** support disabled notification storage ([afaba0b](https://github.com/invertase/react-native-firebase/commit/afaba0b3862b65a2bd83bbbfebfae3ac576811fd))
+
+## [26.3.3](https://github.com/invertase/react-native-firebase/compare/v26.3.2...v26.3.3) (2026-09-01)
+
+### Bug Fixes
+
+- **e2e:** ready-gate Firebase emulator startup ([9ca2aec](https://github.com/invertase/react-native-firebase/commit/9ca2aecc2aa9140c38749d68ab3c23ac23ca8f46))
+- **e2e:** restart Metro with a status gate ([4846e4e](https://github.com/invertase/react-native-firebase/commit/4846e4e345791cd95d7f7952c84a7c229a1f59aa))
+- **ios:** align TurboModule constants return type with generated spec ([c79e1d2](https://github.com/invertase/react-native-firebase/commit/c79e1d2bc43b00a6ef61d38a294feceaed447740)), closes [#9212](https://github.com/invertase/react-native-firebase/issues/9212)
+- **ios:** harden Expo linkage restore diagnostics ([c6e960b](https://github.com/invertase/react-native-firebase/commit/c6e960ba47e881a848e93d60cf09ea2064b24d1b))
+- **ios:** link FirebaseCore into Expo app target under SPM ([18f1d46](https://github.com/invertase/react-native-firebase/commit/18f1d4645ef2b59c03436cf7fa68e6ad39ba9805))
+- **ios:** persist Pods explicit-modules off after post_integrate ([54b3a4a](https://github.com/invertase/react-native-firebase/commit/54b3a4a9913d4601cc5562f559e8b9c8e799e105))
+- **ios:** point SPM Podfile fallbacks at post_integrate ([21191ac](https://github.com/invertase/react-native-firebase/commit/21191acd767b045150dd40af07192d6c735c918e))
+- **ios:** restore RNFB dynamic linkage after Expo prebuilt downgrade ([1d6d80d](https://github.com/invertase/react-native-firebase/commit/1d6d80de01592bd2f38a4270ab268fa40d27a16a))
+- **ios:** warn when Expo linkage restore cannot run ([fecb129](https://github.com/invertase/react-native-firebase/commit/fecb129418066ae035ae2a271cf11466e508db54))
+
+### Reverts
+
+- Revert "chore(release): release packages" ([0a85268](https://github.com/invertase/react-native-firebase/commit/0a85268ae21c706cf1392eaa5b088e85c3273cb7))
+
 ## [26.3.2](https://github.com/invertase/react-native-firebase/compare/v26.3.1...v26.3.2) (2026-08-21)
 
 **Note:** Version bump only for package @react-native-firebase/app

package/RNFBApp.podspec

@@ -25,7 +25,7 @@ Pod::Spec.new do |s|
   s.cocoapods_version   = '>= 1.12.0'
   s.source_files        = "ios/**/*.{h,m,mm,cpp}"
   s.private_header_files = "ios/**/*.h"
-  s.exclude_files       = 'ios/generated/RCTThirdPartyComponentsProvider.*', 'ios/generated/RCTAppDependencyProvider.*', 'ios/generated/RCTModuleProviders.*', 'ios/generated/RCTModulesConformingToProtocolsProvider.*', 'ios/generated/RCTUnstableModulesRequiringMainQueueSetupProvider.*'
+  s.exclude_files       = 'ios/generated/RCTThirdPartyComponentsProvider.*', 'ios/generated/RCTAppDependencyProvider.*', 'ios/generated/RCTModuleProviders.*', 'ios/generated/RCTModulesConformingToProtocolsProvider.*', 'ios/generated/RCTUnstableModulesRequiringMainQueueSetupProvider.*', 'ios/*UnitTests/**'
 
   # Fail fast for old architecture users, but safely in case the variable goes away
   # completely in future react-native versions

package/android/src/main/java/io/invertase/firebase/common/RNFBHandleCollisionException.java

@@ -0,0 +1,31 @@
+package io.invertase.firebase.common;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+/**
+ * Thrown when {@link RNFBHandleMap#put} is asked to register an id that is already occupied.
+ *
+ * <p>This is a checked exception ({@code extends Exception}, not {@link RuntimeException}) so
+ * callers must handle collisions explicitly. There is no upsert: replace an existing registration
+ * with {@code take} then {@code put}.
+ */
+public class RNFBHandleCollisionException extends Exception {
+  public RNFBHandleCollisionException(Object id) {
+    super("Handle id already registered: " + id);
+  }
+}

package/android/src/main/java/io/invertase/firebase/common/RNFBHandleMap.java

@@ -0,0 +1,150 @@
+package io.invertase.firebase.common;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.function.Predicate;
+
+/**
+ * Thread-safe id → handle registry. The lock only moves pointers; this class never invokes methods
+ * on stored values (no SDK {@code cancel}/{@code remove}). Callers {@link #take} or {@link
+ * #takeAll}, then act on the returned object(s) outside the lock.
+ *
+ * <p>{@link #put} is unique: an occupied id throws {@link RNFBHandleCollisionException}. There is
+ * no upsert. Use {@link #putIfAbsent} (first wins), {@link #putIfAbsentOrSame} (first wins or same
+ * instance), or {@link #putReplacing} (last wins) for atomic upsert. Replace at the call site with
+ * {@code take} then {@code put} only when neither helper fits.
+ *
+ * <p><strong>Do not lock on the map or on a {@code RNFBHandleMap} instance.</strong> Callers that
+ * synchronize on {@code this} (or on the internal map) can deadlock with the dedicated monitor.
+ * Android uses a private {@code lock} object; never expose it and never {@code synchronized (this)}
+ * around these methods.
+ */
+public class RNFBHandleMap<K, V> {
+  private final Object lock = new Object();
+  private final HashMap<K, V> map = new HashMap<>();
+
+  /**
+   * Registers {@code handle} under {@code id}.
+   *
+   * @throws RNFBHandleCollisionException if {@code id} is already occupied
+   */
+  public void put(K id, V handle) throws RNFBHandleCollisionException {
+    synchronized (lock) {
+      if (map.containsKey(id)) {
+        throw new RNFBHandleCollisionException(id);
+      }
+      map.put(id, handle);
+    }
+  }
+
+  /**
+   * Stores {@code handle} under {@code id} only when the id is free (first wins).
+   *
+   * @return {@code true} if stored, {@code false} if {@code id} was already occupied
+   */
+  public boolean putIfAbsent(K id, V handle) {
+    synchronized (lock) {
+      if (map.containsKey(id)) {
+        return false;
+      }
+      map.put(id, handle);
+      return true;
+    }
+  }
+
+  /**
+   * Under one lock: stores {@code handle} when the id is free, or returns {@code true} when the
+   * existing mapping is the same instance ({@code ==}). Returns {@code false} when occupied by a
+   * different handle.
+   */
+  public boolean putIfAbsentOrSame(K id, V handle) {
+    synchronized (lock) {
+      V existing = map.get(id);
+      if (existing == null) {
+        map.put(id, handle);
+        return true;
+      }
+      return existing == handle;
+    }
+  }
+
+  /**
+   * Atomically replaces the mapping for {@code id} (last wins). Returns the previous handle, or
+   * {@code null} if the id was free.
+   */
+  public V putReplacing(K id, V handle) {
+    synchronized (lock) {
+      return map.put(id, handle);
+    }
+  }
+
+  /**
+   * Peeks at the handle for {@code id} without removing it (for emit while still registered).
+   *
+   * @return the handle, or {@code null} if absent
+   */
+  public V get(K id) {
+    synchronized (lock) {
+      return map.get(id);
+    }
+  }
+
+  /**
+   * Removes and returns the handle for {@code id}.
+   *
+   * @return the handle, or {@code null} if absent
+   */
+  public V take(K id) {
+    synchronized (lock) {
+      return map.remove(id);
+    }
+  }
+
+  /**
+   * When {@code id} is mapped and {@code shouldTake} accepts the handle, removes and returns it;
+   * otherwise returns {@code null} and leaves the map unchanged. Lookup, predicate, and removal run
+   * under one lock — use for check-and-take that must not race with concurrent {@link #put} /
+   * {@link #take} on the same id.
+   *
+   * <p>The predicate runs under this map's lock; keep it lightweight (no SDK cancel/remove).
+   */
+  public V takeIf(K id, Predicate<V> shouldTake) {
+    synchronized (lock) {
+      V value = map.get(id);
+      if (value != null && shouldTake.test(value)) {
+        return map.remove(id);
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Snapshot of current values, then clear. Cancel/remove each returned object after this method
+   * returns, not under this map's lock.
+   */
+  public List<V> takeAll() {
+    synchronized (lock) {
+      List<V> values = new ArrayList<>(map.values());
+      map.clear();
+      return values;
+    }
+  }
+}

package/android/src/main/java/io/invertase/firebase/common/TaskExecutorService.java

@@ -22,7 +22,8 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.RejectedExecutionHandler;
 import java.util.concurrent.SynchronousQueue;
 import java.util.concurrent.ThreadPoolExecutor;
@@ -73,7 +74,16 @@ public class TaskExecutorService {
 
   private ExecutorService getNewExecutor(boolean isTransactional) {
     if (isTransactional) {
-      return Executors.newSingleThreadExecutor();
+      // A bare Executors.newSingleThreadExecutor() has no rejection handler, so a
+      // play-services Task completing after shutdown() (module invalidation racing
+      // in-flight work, e.g. App Check attestation or Auth network calls finishing
+      // while the React instance is torn down) posts to the dead executor and
+      // crashes the process with an uncaught RejectedExecutionException. Use an
+      // equivalent single-thread pool that discards work arriving after shutdown.
+      ThreadPoolExecutor transactionalExecutor =
+          new ThreadPoolExecutor(1, 1, 0L, TimeUnit.MILLISECONDS, new LinkedBlockingQueue<>());
+      transactionalExecutor.setRejectedExecutionHandler(discardAfterShutdown);
+      return transactionalExecutor;
     } else {
       ThreadPoolExecutor threadPoolExecutor =
           new ThreadPoolExecutor(
@@ -83,9 +93,23 @@ public class TaskExecutorService {
     }
   }
 
+  private static final RejectedExecutionHandler discardAfterShutdown =
+      (r, executor) -> {
+        // isShutdown() remains true through the terminating and terminated states,
+        // so it is the only check needed to detect work arriving after shutdown.
+        if (executor.isShutdown()) {
+          return;
+        }
+        // Unreachable with an unbounded queue, but preserve AbortPolicy semantics
+        // for any rejection that is not caused by shutdown.
+        throw new RejectedExecutionException("Task " + r + " rejected from " + executor);
+      };
+
   private final RejectedExecutionHandler executeInFallback =
       (r, executor) -> {
-        if (executor.isShutdown() || executor.isTerminated() || executor.isTerminating()) {
+        // isShutdown() remains true through the terminating and terminated states,
+        // so it is the only check needed to detect work arriving after shutdown.
+        if (executor.isShutdown()) {
           return;
         }
         ExecutorService fallbackExecutor = getTransactionalExecutor();

package/android/src/reactnative/java/io/invertase/firebase/app/NativeRNFBTurboApp.java

@@ -35,11 +35,12 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 public class NativeRNFBTurboApp extends NativeRNFBTurboAppSpec implements LifecycleEventListener {
   private static final String TAG = "App";
 
-  public static Map<String, String> authDomains = new HashMap<>();
+  public static final Map<String, String> authDomains = new ConcurrentHashMap<>();
 
   NativeRNFBTurboApp(ReactApplicationContext reactContext) {
     super(reactContext);
@@ -134,6 +135,7 @@ public class NativeRNFBTurboApp extends NativeRNFBTurboAppSpec implements Lifecy
 
     if (firebaseApp != null) {
       firebaseApp.delete();
+      authDomains.remove(appName);
     }
 
     promise.resolve(null);

package/android/src/reactnative/java/io/invertase/firebase/app/ReactNativeFirebaseVersion.java

@@ -18,5 +18,5 @@ package io.invertase.firebase.app;
  */
 // generated file - do not modify or commit
 public class ReactNativeFirebaseVersion {
-  public static String VERSION = "26.3.2";
+  public static String VERSION = "26.4.0";
 }

package/android/src/reactnative/java/io/invertase/firebase/common/RCTConvertFirebase.java

@@ -57,8 +57,9 @@ public class RCTConvertFirebase {
     options.put("messagingSenderId", appOptions.getGcmSenderId());
     options.put("storageBucket", appOptions.getStorageBucket());
 
-    if (NativeRNFBTurboApp.authDomains.get(name) != null) {
-      options.put("authDomain", NativeRNFBTurboApp.authDomains.get(name));
+    String authDomain = NativeRNFBTurboApp.authDomains.get(name);
+    if (authDomain != null) {
+      options.put("authDomain", authDomain);
     }
 
     root.put("options", options);

package/android/src/reactnative/java/io/invertase/firebase/common/ReactNativeFirebaseJSON.java

@@ -21,6 +21,7 @@ import com.facebook.react.bridge.Arguments;
 import com.facebook.react.bridge.WritableMap;
 import io.invertase.firebase.BuildConfig;
 import java.util.ArrayList;
+import java.util.Iterator;
 import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
@@ -91,11 +92,12 @@ public class ReactNativeFirebaseJSON {
 
   public WritableMap getAll() {
     WritableMap writableMap = Arguments.createMap();
+    if (jsonObject == null) return writableMap;
 
-    JSONArray keys = jsonObject.names();
-    for (int i = 0; i < keys.length(); ++i) {
+    Iterator<String> keys = jsonObject.keys();
+    while (keys.hasNext()) {
       try {
-        String key = keys.getString(i);
+        String key = keys.next();
         SharedUtils.mapPutValue(key, jsonObject.get(key), writableMap);
       } catch (JSONException e) {
         // ignore

package/android/src/test/java/io/invertase/firebase/app/NativeRNFBTurboAppTest.java

@@ -37,6 +37,7 @@ import com.facebook.react.bridge.ReactContext;
 import com.facebook.react.bridge.ReadableMap;
 import com.facebook.react.bridge.WritableMap;
 import com.google.firebase.FirebaseApp;
+import com.google.firebase.FirebaseOptions;
 import io.invertase.firebase.common.RCTConvertFirebase;
 import io.invertase.firebase.common.ReactNativeFirebaseEventEmitter;
 import io.invertase.firebase.common.ReactNativeFirebaseJSON;
@@ -63,7 +64,7 @@ import org.robolectric.shadows.ShadowLooper;
  * preferences bridges.
  */
 @RunWith(RobolectricTestRunner.class)
-@Config(sdk = 34, application = NativeRNFBTurboAppTest.HostApplication.class)
+@Config(application = NativeRNFBTurboAppTest.HostApplication.class)
 public class NativeRNFBTurboAppTest {
 
   public static class HostApplication extends Application implements ReactApplication {
@@ -206,6 +207,28 @@ public class NativeRNFBTurboAppTest {
     assertFalse(NativeRNFBTurboApp.authDomains.containsKey("secondary"));
   }
 
+  @Test
+  public void firebaseAppToMap_includesOnlyConfiguredAuthDomain() {
+    FirebaseApp firebaseApp = mock(FirebaseApp.class);
+    FirebaseOptions options = mock(FirebaseOptions.class);
+    when(firebaseApp.getName()).thenReturn("secondary");
+    when(firebaseApp.getOptions()).thenReturn(options);
+
+    NativeRNFBTurboApp.configureAuthDomain("secondary", "example.firebaseapp.com");
+    Map<String, Object> appWithAuthDomain = RCTConvertFirebase.firebaseAppToMap(firebaseApp);
+    @SuppressWarnings("unchecked")
+    Map<String, Object> optionsWithAuthDomain =
+        (Map<String, Object>) appWithAuthDomain.get("options");
+    assertEquals("example.firebaseapp.com", optionsWithAuthDomain.get("authDomain"));
+
+    NativeRNFBTurboApp.configureAuthDomain("secondary", null);
+    Map<String, Object> appWithoutAuthDomain = RCTConvertFirebase.firebaseAppToMap(firebaseApp);
+    @SuppressWarnings("unchecked")
+    Map<String, Object> optionsWithoutAuthDomain =
+        (Map<String, Object>) appWithoutAuthDomain.get("options");
+    assertFalse(optionsWithoutAuthDomain.containsKey("authDomain"));
+  }
+
   @Test
   public void setAutomaticDataCollectionEnabled_delegatesToFirebaseApp() {
     FirebaseApp firebaseApp = mock(FirebaseApp.class);
@@ -223,6 +246,7 @@ public class NativeRNFBTurboAppTest {
   public void deleteApp_deletesWhenInstancePresent() {
     FirebaseApp firebaseApp = mock(FirebaseApp.class);
     Promise promise = mock(Promise.class);
+    NativeRNFBTurboApp.configureAuthDomain("secondary", "example.firebaseapp.com");
     try (MockedStatic<FirebaseApp> firebaseApps = mockStatic(FirebaseApp.class)) {
       firebaseApps.when(() -> FirebaseApp.getInstance("secondary")).thenReturn(firebaseApp);
 
@@ -230,6 +254,7 @@ public class NativeRNFBTurboAppTest {
       module.deleteApp("secondary", promise);
 
       verify(firebaseApp).delete();
+      assertFalse(NativeRNFBTurboApp.authDomains.containsKey("secondary"));
       verify(promise).resolve(null);
     }
   }