• Fixed an issue where the deploy MCP tool failed with authentication errors during Data Connect deployment.
• Refined the `login` MCP tool description and security verification instructions to enforce Session ID output for agents and prevent phishing attacks (#10942).
• Added `reauth` option to `login` MCP tool and aligned behavior to skip login and display account email if already authenticated.
• Updated Pub/Sub emulator to version 0.8.35.
• Added extensions replacement registry and scraper tool to track migrations for deprecated extensions ahead of the March 2027 decommission date.
• Load existing .env files and passes environment variables to functions discovery in runtimeDelegate.
• Adds --immediate flag to ext:uninstall (#10921)
• Updated dataconnect emulator version to v3.4.18.
• Fixed a bug where deploying Dart functions with dependencies that use native build hooks (e.g. sqlite3) failed to compile. Note: Dart functions now require Dart SDK 3.13.0 or later.

Release preview.4 addressing shell wrapper option parsing and npm lifecycle scripts:

• Fixed runtime/shell argument parsing for npm's '-c --' invocations (fixing protobufjs postinstall and predeploy lint/build)
• Redirected runtime/node wrapper directly to 'is:node' for robust node eval (-e), version (-v), and script execution
• Preserved PATH environment across child subshells

• Fixed an issue where managed service accounts for declarative security were not deleted when all functions in a codebase were deleted, or caused IAM permission errors on empty codebase deploys.
• Configured OneMCP server tools to require a Firebase project by default, with options to opt-out specific tools (such as Developer Knowledge document search).
• Fixed a bug where deploying functions with the dartfunctions experiment enabled could incorrectly prompt to delete existing GCF v2 functions.
• Added outputSchema support for local MCP tools.
• Skip functions lifecycle hooks during partial (filtered) deployments, and print instructions for running them manually.
• Added appcheck:providers:list, appcheck:providers:get and appcheck:providers:set to configure App Check attestation providers for an app.
• Added appcheck:apps:list to show every app with its configured App Check providers.
• Added web app support for Crashlytics MCP tools and prompts.
• Added support for forwarding custom HTTP headers (Mcp-Param-*) to remote MCP tools when defined in tool parameter input schemas (x-mcp-header), per SEP-2243.
• Improved function parameter prompting clarity for multi-codebase deploys (#10897)

Release preview.3 addressing all bug bash findings:

• Fixed CWD binary name collision in SEA child script resolver
• Bundled missing TypeScript and project init templates
• Added #!/bin/sh shebang to runtime wrapper binaries (fixing exec format error in predeploy)
• Improved WebSocket transport shutdown in logging emulator

Experimental standalone binaries with automated Mach-O ad-hoc code signing and true Universal 2 binaries.

Experimental standalone binaries for firebase-tools built using Node 26 Single Executable Applications (SEAs).

• Automatically enable non-interactive mode when an AI agent is detected in the environment to prevent the CLI from hanging on interactive prompts.
• Added support for a two-phase non-interactive login flow. Initiate this by running firebase login --non-interactive, navigate to the printed link to get an authorization code, and complete the login by running firebase login <auth_code>.
• Fixed apps:init writing google-services.json to an app/app path when the Android module has no src directory, by detecting the module from the directory basename instead of the first path segment (#10863).
• Fixed firestore:locations failing with a null project error when run without an active project (#10881).
• Fixed authentication refresh issue under Application Default Credentials (ADC) when no project is active (#10880).
• Added crashlytics:onboard:web CLI command to support Crashlytics onboarding for web apps.
• Added hidden source map support to crashlytics:sourcemap:upload.
• Fixed typo in loginPrototyper URL which caused issues during Firebase MCP server firebase_login
• Added appcheck:services:list, appcheck:services:get and appcheck:services:set to read and change App Check enforcement per service.
• Fixed unenforced read-only isolation for Native SQL queries for Firebase SQL Connect.

• Fix typo that was breaking the emulator handling of secret params (issue #10866)
• Fixes service account propagation delays during Cloud Functions deploys and cleans up newly created service accounts on 100% deployment failure (#10871).
• Fixed appcheck:debugtokens:list and appcheck:debugtokens:delete prompting "Select the app to register a debug token for" when asking which app to operate on.

• Update Firestore emulator to v1.22.0, adding support for DML
• Add appcheck:debugtokens:create, appcheck:debugtokens:list, and appcheck:debugtokens:delete CLI commands for managing App Check debug tokens (#10801).
• Add MCP-Protocol-Version, Mcp-Method, and Mcp-Name HTTP headers to OneMcpServer requests per the MCP 0728 standard release candidate (https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ and https://modelcontextprotocol.io/seps/2243-http-standardization).
• Fixes Storage Emulator to support JSON uploads larger than 100KB without hanging or throwing 413 error (#8355)
• Add extdeprecationwarnings experiment to display phased deprecation notices and guidance across ext:* CLI commands.
• Fixes Data Connect emulator crash when in-flight GraphQL requests are cancelled (#10821)
• Fixed a Cloud Storage emulator hang under concurrent requests, caused by the rules runtime's stdout being parsed per-chunk instead of per-line so batched responses were dropped (#6194, #6865).
• Support for specifying that the input for a string or string[] param in Functions must be non-empty (#10678)
• Removed the warning that Dart functions may not yet be visible in the Firebase Console, since they are now shown.
• Add the V1 environment variable FUNCTION_REGION to v2 functions (#10862)

• Add declarative security support and automated rolling IAM role grants/revocations for 2nd gen Cloud Functions
• Fixed an issue in apps:create where App Store ID was always prompted for even when unnecessary.
• Add functions:lifecycle:list and functions:lifecycle:run commands to view and run
  lifecycle hooks in isolation.
• Updated the Firebase SQL Connect local toolkit to v3.4.15, which supports for 1:1 nested mutations. (#10773)
• Support for specifying that the input for a string or string[] param in Functions must be non-empty (#10678)
• Removed the warning that Dart functions may not yet be visible in the Firebase Console, since they are now shown.
• Fixed dataconnect:execute command help text. The right env var should be FIREBASE_DATA_CONNECT_EMULATOR_HOST, with an underscore between DATA and CONNECT.
• Updated the Firebase SQL Connect local toolkit to v3.4.16, which includes the following changes:
  • Updated the Golang dependency version to 1.25.12.
• Fixed a Hosting emulator timeout when a web frameworks request with a body falls through to a function rewrite. (#10760)