js: migrate Firebase from v7 (namespaced) to v11 (modular SDK)#408
Merged
Conversation
The React web client used `firebase ^7.19.0` (resolving to 7.24.0, last released 2020-10-26 — 5 years and 4 major versions behind current) and the deprecated `@react-firebase/auth ^0.2.10` (last released 2019-11-13). The namespaced API the v7 SDK exposes was removed entirely in v10; @react-firebase/auth does not work against v9+. Migrate to the v11 modular SDK, drop @react-firebase/auth, and rewrite the one component that used Firebase (login_firebase.js) to subscribe to auth state with the native `onAuthStateChanged` hook. - package.json: firebase ^7.19.0 -> ^11.10.0, remove @react-firebase/auth. - login_firebase.js: rewritten from a class component using `firebase.auth().signInWithPopup(...)` + `<FirebaseAuthProvider>` + `<FirebaseAuthConsumer>` to a function component using `initializeApp` / `getAuth` / `signInWithPopup` / `onAuthStateChanged` from the modular `firebase/app` and `firebase/auth` entry points. - package-lock.json: regenerated. Server-side JWT verification (envoy.yaml `firebase_jwt` provider, JWKS endpoint, issuer/audience) is unchanged — only the client SDK was swapped. Existing tokens issued by the same Firebase project continue to validate. Bundle size: 203.92 KB gzipped (vs 237.96 KB previously). The modular SDK's tree-shaking removes ~34 KB despite the major version bump. Unblocks investigation of long-standing webrtc/login issues that were previously stuck on the obsolete Firebase 7 SDK.
This was referenced May 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
js/web demo pinsfirebase 7.19.0(the last namespaced/legacy v7 release). Firebase v8 deprecated the namespaced API; v9+ ships the tree-shakable modular SDK and v10 dropped the v7 compat shim entirely. Staying on v7 blocks any other dep bump that transitively pulls a newer Firebase, and v7 itself has been EOL for years.What
Single commit. Migrates
js/src/components/login_firebase.jsfrom the v7 namespaced API:to the v11 modular API:
package.jsonbumpsfirebase: "^7.19.0"→"^11.10.0".@react-firebase/auth(deprecated, only used as a v7 helper) is removed — the modular SDK does everything it did and more.Test plan
Verified end-to-end against a Firebase project I own (not the dead
android-emulator-webrtc-demoreferenced in the in-repo config — see follow-up note below):npm install && npm startbuilds clean on react-scripts 5onAuthStateChangedfires,getIdToken()returns a JWTTokenProviderService.setTokenasBearer <jwt>EmulatorScreenjs/develop/envoy.yaml) validates the Firebase JWT against the issuer/audience, proxies gRPC-Web to the emulator containerFollow-up (separate PR)
The bundled
js/firebase_config.jsonstill points atandroid-emulator-webrtc-demo, which nobody currently has access to. That project has been broken since at least commit 5197542 ("Envoy not recognizing Firebase tokens"). A follow-up PR will restructure the demo to BYO-Firebase: ship afirebase_config.example.jsontemplate, fix the (currently no-op) substitution bug inconfig_gen.py, parameterize the envoy JWT issuer/audience, and document the setup injs/README.md. That's a docs/structural change, kept out of this PR to keep the SDK migration reviewable on its own.