chore: bump @react-native-firebase/* 20.1.0 → 23.8.8 by janicduplessis · Pull Request #7319 · rainbow-me/rainbow

janicduplessis · 2026-04-09T21:22:05Z

Fixes APP-3606, APP-3614

What changed (plus any additional context for devs)

Bumps the React Native Firebase suite from 20.1.0 to 23.8.8 — a major version jump that upgrades the underlying Firebase iOS SDK from v10 to v12 and the Android Firebase BoM accordingly.

@react-native-firebase/app, @react-native-firebase/messaging, and @react-native-firebase/remote-config pinned to 23.8.8.
@lavamoat/allow-scripts entries for two new transitive dependencies the upgrade brings in (protobufjs, @firebase/util).
Android gradle plugins updated to the versions react-native-firebase v23.8.8 recommends: google-services 4.4.4 and firebase-crashlytics-gradle 3.0.6. The crashlytics plugin was a major version behind, which can cause deobfuscation issues in crash reports.
globalThis.RNFB_SILENCE_MODULAR_DEPRECATION_WARNINGS is set in index.js. v23 deprecated the namespaced API (messaging().getToken(), remoteConfig().fetchAndActivate(), etc.) and emits a console.warn on every call; Sentry captures console.warn as breadcrumbs, so without the flag ~7+ warnings fire on every cold start and blow through the breadcrumb budget before any useful crash diagnostics land. Migration to the modular API is tracked in FEPLAT-80.

Heads-up for app store review / binary audits: Firebase iOS SDK v12 restructured analytics packaging and now transitively pulls in GoogleAdsOnDeviceConversion 3.3.0 via GoogleAppMeasurement/Default. We don't use it, but it's compiled into the binary.

Requires companion rainbow-scripts PR: https://github.com/rainbow-me/rainbow-scripts/pull/217 (updates native module whitelist paths from lib/ to dist/module/ for v23).

Screen recordings / screenshots

N/A

What to test

Push notifications: receive in foreground, background, and killed state; tap to open
Remote config: verify feature flags load correctly on app launch
Cold start: no Firebase initialization crashes or warnings in logs

Validation done

Android: FCM token obtained successfully, registered with echo server (response: SUCCESS), remote config loaded (103 keys)
iOS (simulator): FCM token correctly unavailable (simulator limitation), remote config loaded successfully (102 keys, fetchAndActivate: true)
Both platforms: app starts without Firebase crashes, dapp_browser and other remote config flags resolve correctly

socket-security · 2026-04-09T23:10:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@react-native-firebase/app@20.1.0 ⏵ 23.8.8		⁺²	⁺²
npm/@react-native-firebase/messaging@20.1.0 ⏵ 23.8.8	⁺¹	⁺¹	⁺²
npm/@react-native-firebase/remote-config@20.1.0 ⏵ 23.8.8	^-1	⁺¹	⁺²

View full report

linear · 2026-04-10T00:07:21Z

APP-3606 Bump @react-native-firebase/* 20.1.0 → 23.8.8

APP-3614 Upgrade outdated Firebase module due to deprecation warning

github-actions · 2026-04-10T01:19:19Z

Launch in simulator or device for e5a40cc

janicduplessis · 2026-04-10T02:28:49Z

Important

Companion PR: https://github.com/rainbow-me/rainbow-scripts/pull/217 (updates firebase native module whitelist path from nativeModule.js to nativeModuleAndroidIos.js)

Note

TODO: Migrate firebase consumers from namespaced API to modular API — FEPLAT-80

olerass · 2026-04-15T09:05:08Z

Couple things from reviewing the diff + tracing the consumer files:

Deprecation warnings flooding sentry breadcrumbs
v23 deprecated the namespaced API (messaging().getToken(), remoteConfig().fetchAndActivate(), etc) and emits a console.warn on every call. All our consumer files use this style, so wed get ~7+ warnings on every cold start alone. Since sentry captures console.warn as breadcrumbs and we have maxBreadcrumbs at 10, these basically fill up the entire breadcrumb budget within seconds of launch, pushing out actually useful crash diagnostics.

One-liner fixcould add this early in app init (e.g. index.js before firebase imports):

globalThis.RNFB_SILENCE_MODULAR_DEPRECATION_WARNINGS = true

(eventual migration to the modular API is a separate task, namespaced works fine until the next major afaics)

Android gradle plugin versions
The firebase BoM jumped from 33.1.0 to 34.10.0 but android/build.gradle still has google-services:4.3.15 and firebase-crashlytics-gradle:2.9.2 (recommended: 4.4.4 and 3.0.6 from https://github.com/invertase/react-native-firebase/blob/v23.8.8/packages/app/package.json#L110-L122). The crashlytics one is a major version behind which could cause deobfuscation issues in crash reports. Not blocking but probably worth bumping while we're in here.

GoogleAdsOnDeviceConversion pod
Just flagging since firebase iOS SDK v12 restructured analytics packaging and now pulls in GoogleAdsOnDeviceConversion 3.3.0 transitively via GoogleAppMeasurement/Default. Our app doesn't use it ofc, but it's compiled into the binary. Might be worth noting in the PR description for visibility since it could come up in app store review or binary audits. Otherwize not actionable in this PR afaiu, just good to be aware of.

github-actions · 2026-04-15T16:50:00Z

Launch in simulator or device for 708dfd3

github-actions · 2026-04-15T16:50:58Z

🧪 Flashlight Performance Report (AWS Device Farm)

🔀 Commit: 94a76f5

📎 View Artifacts

Metric	Current	Δ vs Baseline
Time to Interactive (TTI)	2666 ms	🔴 +177.5 ms (+7.1%)
Average FPS	59.71	⚪ +0.0 (+0.1%)
Average RAM	464.1 MB	⚪ -3.4 MB (-0.7%)

…dle plugins - Set `RNFB_SILENCE_MODULAR_DEPRECATION_WARNINGS` early in index.js so the namespaced-API deprecation `console.warn`s don't fill Sentry's breadcrumb budget on every cold start. - Bump google-services 4.3.15 → 4.4.4 and firebase-crashlytics-gradle 2.9.2 → 3.0.6 to match what react-native-firebase v23.8.8 recommends (crashlytics plugin was a major version behind, which can cause deobfuscation issues in crash reports).

github-actions · 2026-04-15T19:03:45Z

Launch in simulator or device for ddf3b47

github-actions · 2026-04-16T04:09:57Z

Launch in simulator or device for 3d6fb1a

After bumping `@react-native-firebase/*` from 20.1.0 to 23.8.8 in #7319 (Apr 2026), iOS users see both a system banner AND a notifee-displayed local notification when a push arrives while the app is foregrounded. Pre-bump behavior was the notifee notification only. The cause is upstream: invertase/react-native-firebase#8786 (merged Feb 2026, shipped in v23.8.5) reordered RNFB's iOS `willPresent` delegate so the original AppDelegate handler is called first. Previously, RNFB consumed the one-shot `completionHandler` with its own default options (empty, since we don't have a `firebase.json`) before forwarding to AppDelegate, making AppDelegate's `completionHandler([.sound, .badge, .list, .banner])` a no-op. With the new order, AppDelegate wins and iOS now honors the full `[.sound, .badge, .list, .banner]` set the handler has been quietly asking for since #6607 (Aug 2025). This change updates AppDelegate's `willPresent` to call `completionHandler([])`, which suppresses all iOS-side presentation for the FCM remote when foregrounded. Rainbow's user-visible foreground notification UI is rendered by notifee from the separate `onMessage` JS handler (`src/notifications/foregroundHandler.ts` → `notifee.displayNotification`). Letting iOS also present the FCM payload would duplicate Notification Center entries and add badge increments that pre-bump prod never had. Returning `[]` matches the pre-RNFB-23.8.5 default of `UNNotificationPresentationOptionNone`. Background and killed-app notifications are unaffected since this delegate only runs in the foreground case.

janicduplessis force-pushed the @janic/bump-firebase branch 2 times, most recently from 8b0ec44 to 8284c5b Compare April 9, 2026 23:45

janicduplessis added 2 commits April 15, 2026 12:11

chore: bump @react-native-firebase/* 20.1.0 → 23.8.8

58c6fdd

chore: update lockfiles

78d6ad8

janicduplessis force-pushed the @janic/bump-firebase branch from 05d0ae0 to 55c689d Compare April 15, 2026 16:18

janicduplessis force-pushed the @janic/bump-firebase branch 2 times, most recently from fb8d257 to 5b8f3c4 Compare April 15, 2026 18:10

janicduplessis force-pushed the @janic/bump-firebase branch from 5b8f3c4 to abf1d41 Compare April 15, 2026 18:29

janicduplessis requested a review from olerass April 15, 2026 18:33

janicduplessis enabled auto-merge (squash) April 15, 2026 18:33

olerass reviewed Apr 15, 2026

View reviewed changes

Comment thread index.js Outdated

janicduplessis added 2 commits April 15, 2026 23:57

chore: add TODO comment for firebase modular API migration (FEPLAT-80)

cbb4f64

chore: trim comment on deprecation warning stopgap

f6085b9

olerass approved these changes Apr 16, 2026

View reviewed changes

janicduplessis merged commit a4e17b0 into develop Apr 16, 2026
19 of 20 checks passed

janicduplessis deleted the @janic/bump-firebase branch April 16, 2026 06:08

olerass mentioned this pull request Apr 27, 2026

fix: duplicate foreground notification on iOS #7391

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump @react-native-firebase/* 20.1.0 → 23.8.8#7319

chore: bump @react-native-firebase/* 20.1.0 → 23.8.8#7319
janicduplessis merged 5 commits intodevelopfrom
@janic/bump-firebase

janicduplessis commented Apr 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

linear Bot commented Apr 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 10, 2026

Uh oh!

janicduplessis commented Apr 10, 2026 •

edited

Loading

Uh oh!

olerass commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

janicduplessis commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed (plus any additional context for devs)

Screen recordings / screenshots

What to test

Validation done

Uh oh!

socket-security Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear Bot commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 10, 2026

Uh oh!

janicduplessis commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olerass commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

janicduplessis commented Apr 9, 2026 •

edited

Loading

socket-security Bot commented Apr 9, 2026 •

edited

Loading

linear Bot commented Apr 10, 2026 •

edited

Loading

janicduplessis commented Apr 10, 2026 •

edited

Loading

github-actions Bot commented Apr 15, 2026 •

edited

Loading