Firebase breaking changes, updated weekly

Every verified Firebase trap in Footgun: changes and behaviors that break code or give wrong results, newest first. Each one has the error you see, the fix, and the date it was last checked. The list updates when the weekly check adds or retires a trap. For the full cause and sources, open the trap, or see all Firebase traps.

1. fg-0562· added 2026-10-27· last checked 2026-10-27

   Firestore rules that allow read, write: if true let anyone read, change or delete your whole database

   Symptom

   firestore.rules matches /{document=**} with allow read, write: if true;

   Fix

   Require Firebase Authentication and write rules per collection that fit your data, for example letting only a document's owner read, change or delete it, and stopping updates that change the owner. Deploy the rules before launch.

2. fg-0185· added 2026-10-15· last checked 2026-10-15

   admin.messaging().sendMulticast is not a function after upgrading firebase-admin to v13

   Symptom

   TypeError: admin.messaging(...).sendMulticast is not a function

   Fix

   Use send for one message and sendEachForMulticast or sendEach for batches, with the HTTP v1 message shape.

3. fg-0186· added 2026-10-15· last checked 2026-10-15

   firebase-admin 12.2 calls fail asking for the serviceusage.serviceUsageConsumer role

   Symptom

   Caller does not have required permission to use project ... Grant the caller the roles/serviceusage.serviceUsageConsumer role

   Fix

   Upgrade to firebase-admin 13 or later. On 12.x, grant roles/serviceusage.serviceUsageConsumer to the runtime service account.

4. fg-0190· added 2026-10-15· last checked 2026-10-15

   Firebase Storage returns 402 or storage/unauthorized for every request on a Spark plan project

   Symptom

   402: Cloud Storage for Firebase no longer supports Firebase projects that are on the no-cost Spark pricing plan.

   Fix

   Upgrade the project to Blaze, where the no-cost usage tier still applies. New default buckets are named PROJECT_ID.firebasestorage.app, so update storageBucket in config for new projects.

5. fg-0191· added 2026-10-15· last checked 2026-10-15

   Firestore setDoc fails with Unsupported field value: undefined

   Symptom

   FirebaseError: Function setDoc() called with invalid data. Unsupported field value: undefined (found in field middleName in document users/abc)

   Fix

   Initialize Firestore with ignoreUndefinedProperties true, or strip undefined fields before writing. Use null when you want the field stored as empty.

6. fg-0189· added 2026-10-15· last checked 2026-10-15

   Firebase signInWithRedirect returns to the app with no user on Chrome, Safari, or Firefox

   Symptom

   getRedirectResult() resolves to null after a successful Google sign-in

   Fix

   Serve the auth helper from your own domain: set authDomain to the app's domain on Firebase Hosting, or reverse proxy /__/auth/ to PROJECT_ID.firebaseapp.com, and add the new redirect URI at the OAuth provider. Otherwise switch to signInWithPopup.

7. fg-0194· added 2026-10-15· last checked 2026-10-15

   The default Firebase app already exists error on every hot reload in Next.js

   Symptom

   FirebaseAppError: The default Firebase app already exists. This means you called initializeApp() more than once without providing an app name as the second argument.

   Fix

   Reuse the existing app with getApps() before calling initializeApp.

8. fg-0187· added 2026-10-15· last checked 2026-10-15

   Firebase Auth returns auth/invalid-credential instead of auth/user-not-found or auth/wrong-password

   Symptom

   FirebaseError: Firebase: Error (auth/invalid-credential) for both unknown emails and wrong passwords

   Fix

   Treat auth/invalid-credential as a generic bad email or password message and drop flows that look up sign-in methods by email. Turn protection off only if you accept the enumeration risk.

9. fg-0193· added 2026-10-15· last checked 2026-10-15

   npm install fails with ERESOLVE when adding firebase-admin 14 to a Cloud Functions project

   Symptom

   ERESOLVE unable to resolve dependency tree

   Fix

   Upgrade firebase-functions to 7.3.0 or later together with firebase-admin 14. Avoid legacy-peer-deps as a permanent fix.

10. fg-0188· added 2026-10-15· last checked 2026-10-15

    Firebase email link sign-in links stop opening the iOS or Android app after the Dynamic Links shutdown

    Symptom

    Email sign-in, password reset, or verify links open a browser page instead of the app

    Fix

    Update the Auth SDKs, set up App Links or Universal Links for PROJECT_ID.firebaseapp.com or a custom Hosting domain, and pass that domain as linkDomain in ActionCodeSettings.

11. fg-0192· added 2026-10-15· last checked 2026-10-15· deadline 2027-04-01

    functions.config() throws has been removed in firebase-functions v7 after upgrading

    Symptom

    Error: functions.config() has been removed in firebase-functions v7. Migrate to environment parameters using the params module.

    Fix

    Move values to params: defineString or defineInt for plain config, defineSecret for secrets, and defineJsonSecret for a whole JSON blob. Pin firebase-functions below 7 only as a short stopgap.

12. fg-0184· added 2026-10-15· last checked 2026-10-15

    admin.firestore is not a function after upgrading firebase-admin to v14

    Symptom

    TypeError: admin.firestore is not a function

    Fix

    Switch to the modular entry points (firebase-admin/app, /firestore, /auth, /messaging) and run on Node.js 22 or later.