21.0.0-rc.2

Breaking change

App Check no longer runs during server rendering by default (#3773). During server rendering, AngularFire no longer calls the function passed to provideAppCheck, and inject(AppCheck) returns null there. Browser-side behavior is unchanged. This fixes the ReferenceError: document is not defined build failure in server-rendered apps, because the reCAPTCHA providers need a browser.

To keep App Check running during server rendering, provide APP_CHECK_ON_SERVER as true in your server config:

import { APP_CHECK_ON_SERVER } from '@angular/fire/app-check';

// in your server app config's providers
{ provide: APP_CHECK_ON_SERVER, useValue: true },

Details, including how server-side Firebase requests can still carry an App Check token: App Check during server rendering.

Updating from 21.0.0-rc.1

Installing a release candidate saves its exact version, so it does not move on its own. Run:

ng update @angular/fire@21.0.0-rc.2

What's Changed

Installing and upgrading

• fix: remove the unused optional @angular/platform-server peer dependency, which made npm install and ng add @angular/fire fail with ERESOLVE on an app one Angular patch behind the newest release. by @armando-navarro in #3792
• fix: ng update @angular/fire no longer stops before the v21 migration when it runs under Angular CLI 22.3, whose schematics package refuses the file path AngularFire's schematics loaded. by @armando-navarro in #3793
• fix: ng add @angular/fire no longer stops with Invalid project id: myApp. for a project whose name has capital letters. It and ng deploy also no longer crash with Cannot read properties of undefined (reading 'email') on firebase-tools 15.26 or later when run without a terminal, for example by an AI agent. by @armando-navarro in #3769
• fix: the @angular/fire/compat/storage typings no longer import firebase/compat, which failed the build with TS2307 under moduleResolution: "bundler". by @armando-navarro in #3796

Server-side rendering

• fix(app-check)!: skip App Check during server rendering by default. See "Breaking change" above. by @armando-navarro in #3773
• fix: beforeAuthStateChanged from @angular/fire/auth no longer keeps the app from ever becoming stable for a visitor who never signs in or out. Its callback still runs inside Angular's zone and injection context. by @armando-navarro in #3770

Documentation

• docs: the Quickstart lists npm 11.6 or later as a requirement, since older npm, including the npm 10 that ships with Node.js 20 and 22, cannot install a new Angular 21 project (Cannot read properties of null (reading 'edgesOut')). by @armando-navarro in #3787
• docs: the upgrade guide covers ng update stopping with The Angular CLI requires a minimum Node.js version of ..., and how to get past it. by @armando-navarro in #3788
• docs: the App Check guide explains what changes during server rendering, how to run App Check there with APP_CHECK_ON_SERVER, and how to keep App Check out of the server on 21.0.0-rc.1 and earlier. by @armando-navarro in #3775
• docs: the upgrade guide lists the removed @angular/platform-server peer dependency and the App Check change. by @armando-navarro in #3795
• docs: the Quickstart and the upgrade guide install AngularFire 21 with Angular 21, and the product pages point at the Quickstart. by @armando-navarro in #3765
• docs: drop the --save-exact step for the release candidate. by @armando-navarro in #3778

Release tooling

• fix(ci): a release now chooses its npm tag when it publishes, so a 20.x release made after 21.0.0 goes to v20-lts instead of replacing 21 on latest, and next moves up to a stable release that passes it. by @armando-navarro in #3794
• fix: canary builds are named one patch above the newest release of their major, for example 21.0.1-canary.<time>.sha-<commit>. ng add @angular/fire@canary now installs the canary rather than the release candidate, and installing @next or a release candidate never picks up a canary. by @armando-navarro in #3767 and #3780
• fix: canary builds are ordered by commit time, and the canary tag can no longer move back to an older build. by @armando-navarro in #3772 and #3784
• chore: the pull request template asks whether a change is breaking. by @armando-navarro in #3782

Full Changelog: 21.0.0-rc.1...21.0.0-rc.2

20.1.1

What's Changed

Installing and setting up

• fix: remove the unused optional @angular/platform-server peer dependency, which made npm install and ng add @angular/fire fail with ERESOLVE on an app one Angular patch behind the newest release. by @armando-navarro in #3792
• fix: ng add @angular/fire no longer stops with Invalid project id: myApp. for a project whose name has capital letters. It and ng deploy also no longer crash with Cannot read properties of undefined (reading 'email') on firebase-tools 15.26 or later when run without a terminal, for example by an AI agent. by @armando-navarro in #3769

Compiling

• fix: the @angular/fire/compat/storage typings no longer import firebase/compat, which failed the build with TS2307 under moduleResolution: "bundler". by @armando-navarro in #3796

Server-side rendering

• fix: beforeAuthStateChanged from @angular/fire/auth no longer keeps the app from ever becoming stable for a visitor who never signs in or out. Its callback still runs inside Angular's zone and injection context. by @armando-navarro in #3770

Deploying (ng deploy)

• fix: ng deploy stops when a gcloud step fails. Before, a failure with any exit code other than 1 was ignored and the deploy went on to Firebase Hosting as if it had worked. It also passes gcloud arguments as an array, so a space in the workspace path or in GOOGLE_APPLICATION_CREDENTIALS no longer splits them. by @herdiyana256 in #3726
• fix: ng deploy runs its commands without a shell. A workspace path containing a space no longer breaks the Cloud Functions deploy, and values read from angular.json no longer reach a shell. by @herdiyana256 in #3738
• fix: the code and Dockerfile that ng deploy generates for SSR now escape or validate the angular.json values they use (output path, function name, Node.js version). A crafted value could previously place arbitrary code in the generated files. by @herdiyana256 in #3739
• fix: ng deploy writes the generated Cloud Run entry paths with forward slashes on every machine. Running it from Windows wrote backslash paths, which the Linux-based Cloud Run runtime cannot resolve. by @fr-esco in #3274

Release process

• fix: a 20.x release tagged after 21.0.0 publishes to the v20-lts npm tag instead of latest, so it can't replace 21 as the version npm install @angular/fire installs. by @armando-navarro in #3794

Check your angular.json before ng deploy

ng deploy now checks some angular.json values before it starts, and refuses ones that 20.1.0 let through.

One of these checks can stop a deploy that worked on 20.1.0:

• The outputPath of your build and server targets can't contain a backslash, $, a quote, a backtick or a line break, or start with -. A hand-edited Windows-style path such as dist\app\browser is the likely case. Use forward slashes, as the Angular CLI writes them.

Full Changelog: 20.1.0...20.1.1

20.1.0

What's Changed

• feat: ng add @angular/fire now writes the Firebase project files a new app needs. Selecting Firestore generates a .firebaserc carrying your selected project, a firestore.rules file, and a firestore.indexes.json, so the project is deployable without hand-writing them. by @armando-navarro in #3714
• fix: ng add @angular/fire explains itself when nothing is selected. Confirming the feature checklist with no features chosen previously ended the setup silently, as if it had worked. It now prints what happened and how to select features on a re-run. by @armando-navarro in #3717

A note on the generated Firestore rules

The firestore.rules file that ng add writes is Firebase's standard test-mode starter: it allows anyone read and write access to your database, and the rule is written to expire 30 days after generation, after which all client requests are denied. Write real security rules for your app before that date. See Firestore security rules.

Full Changelog: 20.0.3...20.1.0

21.0.0-rc.1

What's Changed

Upgrading to v21

• fix: ng update @angular/fire updates your project's firebase dependency to the supported ^12.18.0, and ng add aligns it during setup, preventing duplicated-SDK installs by @armando-navarro in #3722
• fix: require rxfire 6.2.0 or newer. Older rxfire versions ask for firebase 11, which can install a second Firebase SDK copy next to your firebase 12. by @armando-navarro in #3723
• build: require firebase 12.18.0 or newer. AngularFire wraps four new Cloud Messaging functions: onRegistered, onUnregistered, register and unregister. by @armando-navarro in #3761
• build: require Angular 21.2 or newer. Angular 21 is in long-term support, which ships only critical fixes and security patches, so 21.2 is the final 21.x minor line. Projects still on Angular 21.0 or 21.1 should run ng update @angular/core @angular/cli before updating AngularFire. by @armando-navarro in #3763
• fix: drop the @angular/fire/ai import of the removed Imagen API, which made fresh installs fail to build against firebase 12.18.0. ng update warns remaining Imagen users with migration guidance. by @armando-navarro in #3750
• feat: ng update @angular/fire rewrites imports from the removed Vertex AI module to its replacement, @angular/fire/ai (Firebase AI Logic), including the renamed symbols, and a new guide covers upgrading from AngularFire 20 to 21 by @armando-navarro in #3725
• fix: ng update @angular/fire uses AgentPlatformBackend instead of the deprecated VertexAIBackend. Location defaults to global instead of us-central1. The migration warns for every file whose region changed. by @armando-navarro in #3762

Setting up (ng add)

• feat: ng add @angular/fire warns when multiple versions of firebase are installed, and shows the dependency chain. Prevents various hard-to-diagnose bugs. by @armando-navarro in #3760
• fix: ng add generates working @angular/fire/ai imports when the AI feature is selected, instead of imports from a removed module path. Docs updated to use the Firebase AI Logic naming. by @coturiv in #3685
• fix: remove the @angular/platform-browser-dynamic peer dependency, which made ng add @angular/fire fail with ERESOLVE on Angular 20.1 and newer. by @armando-navarro in #3718
• fix: ng add writes only accepted keys into the app config, which previously did not compile. The whole Firebase CLI response was inlined into initializeApp(), including management fields such as projectNumber that FirebaseOptions rejects, producing TS2769. by @armando-navarro in #3707
• feat: ng add @angular/fire and selecting Firestore generates a .firebaserc file, a firestore.rules file, and a firestore.indexes.json file. by @armando-navarro in #3714
• fix: ng add @angular/fire@next records prerelease installs as the exact installed version. Prevents later installs replacing your chosen AngularFire release candidate. by @armando-navarro in #3709
• fix: ng add @angular/fire prints a helpful message when no features are selected. Previously, the setup ended silently, as if it had worked. by @armando-navarro in #3717
• fix: log the caught error when dataconnect.yaml parsing fails, instead of discarding it by @armando-navarro in #3711
• fix: accept firebase-tools 15. Eliminates peer dependency warnings on install for projects on the current Firebase CLI. by @armando-navarro in #3702
• fix: update the firebase-tools version check error message. by @Muneersahel in #3662

Deploying (ng deploy)

• fix: ng deploy no longer crashes on launch with ERR_INVALID_ARG_TYPE. The schematics ship as a CommonJS bundle, which turned the code's import.meta lookup into undefined before it reached any real work. by @armando-navarro in #3729
• fix: the Cloud Function generated for SSR now asks for Node 22, instead of Node 14, a runtime Cloud Functions decommissioned in early 2025. by @armando-navarro in #3743
• fix: the generated Cloud Function imports region from the firebase-functions/v1 subpath, where firebase-functions 6 moved it. Calling it from the package root threw on the function's first request. by @armando-navarro in #3743
• fix: the Cloud Function generated for SSR now uses a public firebase-functions logger entry point, instead of an internal path that crashed the function at startup by @armando-navarro in #3730
• fix: the package.json generated for SSR deployments declares firebase-admin with a real, installable range. It was omitted even though firebase-functions requires it at load time, so the deployed function could crash with Cannot find module 'firebase-admin/app-check'. by @armando-navarro in #3745
• fix: declare the three packages the schematics require at runtime (jsonc-parser, @angular-devkit/core, @angular-devkit/architect). The published package.json never listed them, so ng deploy failed to resolve modules under pnpm's default layout and Yarn Plug'n'Play. by @armando-navarro in #3747
• fix: ng deploy writes the generated entry paths with forward slashes regardless of the deploying machine. Running it from Windows with the Cloud Run SSR option wrote backslash paths, which the Linux-based Cloud Run runtime cannot resolve. by @fr-esco in #3274

Security hardening

• fix: ng deploy no longer places values read from angular.json into shell commands, closing a command-injection hole by @herdiyana256 in #3738
• fix: the code and Dockerfile that ng deploy generates for SSR now escape or validate the angular.json values they interpolate (output path, function name, Node version). A crafted value could previously place arbitrary code in the generated files. by @herdiyana256 in #3739
• fix: ng deploy passes gcloud arguments as an array. It previously built the command as one string and re-split it on whitespace, so a deploy option containing a space (a region, project, or function name from angular.json) could smuggle extra flags into the gcloud invocation. by @herdiyana256 in #3726
• fix: the provideDataConnect(...) call that ng add generates escapes the values it takes from your dataconnect.yaml/connector.yaml. A value containing a quote character could previously place arbitrary code in the generated file. by @herdiyana256 in #3727

CI and repository health

• ci: upgrade the Java version used by the test emulators from 11 to 21. Current firebase-tools requires Java 21 or newer, so every emulator-backed CI job had been failing at emulator startup. This change is what turned the repo's test pipeline green again. by @mwilman in #3687
• ci: resolve the zizmor security findings in the GitHub Actions workflows by @jhuleatt in #3700

Documentation

• docs: the quickstart and README match what ng add actually does today, with current scaffold names, the Firebase Hosting and App Hosting deploy paths, and the prerequisites called out up front by @armando-navarro in #3736
• docs: the auth guide's Server-side Rendering section is rewritten around a verified working setup. The old snippet did not compile, and each of the four required steps explains what silently breaks without it. by @armando-navarro in #3740
• docs: new guide, Deploying SSR to App Hosting, including how to detect and fix the silent fallback to client-side rendering by @armando-navarro in #3720
• docs: new Data Connect guide, linked from the README feature table by @armando-navarro in #3724
• docs: new injection-context recipe showing how to keep AngularFire calls in an injection context in async code by @armando-navarro in #3721
• docs: the copy-paste samples in the product guides compile as written again by @armando-navarro in #3732
• docs: fix stale links and grammar, remove obsolete doc files by @armando-navarro in #3734
• docs: log the token value in the auth idToken example by @armando-navarro in #3728
• docs: import the pipes correctly in the route-guard examples by @Erick2280 in #3623
• docs: the auth guide's user$ example references the injected this.auth by @arolleagueken...

20.0.3

What's Changed

• fix: remove the @angular/platform-browser-dynamic peer dependency, which made ng add @angular/fire fail with ERESOLVE on Angular 20.1 and newer. It forced npm toward a version whose own requirements clashed with the app's, and nothing in the published package imports it. by @armando-navarro in #3718
• fix: ng add now writes only accepted keys into the app config, which previously did not compile. The whole Firebase CLI response was inlined into initializeApp(), including management fields such as projectNumber that FirebaseOptions rejects, producing TS2769. by @armando-navarro in #3707
• fix: accept firebase-tools 15. The optional peer dependency was capped at ^14.0.0, which excluded the current major, so anyone on the current Firebase CLI saw peer dependency warnings on every install. The range is now ^14.0.0 || ^15.0.0. by @armando-navarro in #3702
• fix: the firebase-tools version check now asks for the version it enforces. It said 13.0.0 or newer while actually requiring 14.0.0 or newer. by @Muneersahel in #3662
• fix: the Cloud Function generated for SSR now uses a public firebase-functions logger entry point, instead of an internal path that crashed the function at startup. by @armando-navarro in #3730
• fix: the package.json generated for SSR deployments now carries real version ranges for firebase-admin and firebase-functions. Both were pinned to the placeholder 0.0.0, so npm install could not resolve them and failed with ETARGET. by @armando-navarro in #3745
• fix: the generated Cloud Function now asks for Node 22, instead of Node 14, a runtime Cloud Functions decommissioned in early 2025. by @armando-navarro in #3743
• fix: the generated Cloud Function now imports region from the firebase-functions/v1 subpath, where firebase-functions 6 moved it. Calling it from the package root threw on the function's first request. by @armando-navarro in #3743
• ci: upgrade the Java version used by the test emulators from 11 to 21 by @mwilman in #3687

New Contributors

• @Muneersahel made their first contribution in #3662
• @mwilman made their first contribution in #3687

A note on ng deploy with SSR

The last three fixes repair defects in the Cloud Function that ng deploy generates, but they do not make SSR deployment to Cloud Functions work end to end on a project created with Angular 17 or newer. That command still looks for a server build target which the current Angular application builder does not create.

If you are deploying a server-side rendered Angular app to Firebase today, App Hosting is the supported path. Plain ng deploy without SSR is unaffected.

Full Changelog: 20.0.1...20.0.3

21.0.0-rc.0

What's Changed

• Bump all Angular dependencies to ^21.0.0 build to ~0.2100.0
• Bump firebase to next major
• Drop vertexai
• Lots of lint and tsconfig drama
• Unbork Github Actions

I fully expect I broke something, there were a lot of build / lint issues with this major. Just need to get the ball rolling here now that all the deps are out. Will publish an update to rxfire to fix the peer conflict.

Full Changelog: 20.0.1...21.0.0-rc.0

20.0.1

What's Changed

• fix: Avoid handling promise rejections twice in stability helper by @atscott in #3657

New Contributors

• @atscott made their first contribution in #3657

Full Changelog: 20.0.0...20.0.1

20.0.0

What's Changed

• Peer on Angular v20
• Peer on firebase-tools v14

Full Changelog: 19.2.0...20.0.0

20.0.0-rc.0

What's Changed

• Peer on Angular v20
• Peer on firebase-tools v14

Full Changelog: 19.2.0...20.0.0-rc.0

19.2.0

What's Changed

• Add @angular/fire/ai entry for Firebase AI by @nohe427 in #3650

New Contributors

• @nohe427 made their first contribution in #3650

Full Changelog: 19.1.0...19.2.0