firebase 5.5.9

Firebase JavaScript library for web and Node.js

firebase@5.5.9 was published on 2018-11-20. Its manifest declares 8 runtime dependencies and 0 peer requirements. Type declarations are bundled according to the package metadata. No Node.js engine requirement is declared in this manifest.

All firebase versions · Permanent reference to 5.5.9 · Latest release

Package specifications

Version	5.5.9
License declaration	Apache-2.0
Published	2018-11-20T22:53:24.510Z
Node.js requirement	Not declared
Type declarations	Bundled declarations
Runtime dependency count	8
Peer requirement count	0
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	5306.06 KiB
Published file count	54
Package type	Not declared
ES module entry	dist/index.esm.js
Default entry	dist/index.node.cjs.js
Side effects declaration	Not declared
Direct advisories	1
Resolved graph dependencies	138
Repository stars	5154
Repository forks	1039

Install firebase 5.5.9

npm install firebase@5.5.9
pnpm add firebase@5.5.9
yarn add firebase@5.5.9

Runtime dependencies

Peer requirements

None declared

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

@firebase/app@0.3.5 — direct
@firebase/app-types@0.3.2 — indirect
@firebase/auth@0.7.9 — direct
@firebase/auth-types@0.3.4 — indirect
@firebase/database@0.3.7 — direct
@firebase/database-types@0.3.2 — indirect
@firebase/firestore@0.8.8 — direct
@firebase/firestore-types@0.7.0 — indirect
@firebase/functions@0.3.3 — direct
@firebase/functions-types@0.2.1 — indirect
@firebase/logger@0.1.2 — indirect
@firebase/messaging@0.3.7 — direct
@firebase/messaging-types@0.2.3 — indirect
@firebase/polyfill@0.3.3 — direct
@firebase/storage@0.2.4 — direct
@firebase/storage-types@0.2.3 — indirect
@firebase/util@0.2.3 — indirect
@firebase/webchannel-wrapper@0.2.11 — indirect
ansi-regex@2.1.1 — indirect
ascli@1.0.1 — indirect
balanced-match@1.0.2 — indirect
brace-expansion@1.1.21 — indirect
bytebuffer@5.0.1 — indirect
camelcase@2.1.1 — indirect
cliui@3.2.0 — indirect
code-point-at@1.1.0 — indirect
colour@0.7.1 — indirect
concat-map@0.0.1 — indirect
core-js@2.5.5 — indirect
decamelize@1.2.0 — indirect
dom-storage@2.1.0 — indirect
encoding@0.1.14 — indirect
faye-websocket@0.11.1 — indirect
fs.realpath@1.0.0 — indirect
glob@7.2.3 — indirect
grpc@1.16.0 — indirect
grpc>1.16.0>abbrev@1.1.1 — indirect
grpc>1.16.0>ansi-regex@2.1.1 — indirect
grpc>1.16.0>aproba@1.2.0 — indirect
grpc>1.16.0>are-we-there-yet@1.1.5 — indirect
grpc>1.16.0>balanced-match@1.0.0 — indirect
grpc>1.16.0>brace-expansion@1.1.11 — indirect
grpc>1.16.0>chownr@1.0.1 — indirect
grpc>1.16.0>code-point-at@1.1.0 — indirect
grpc>1.16.0>concat-map@0.0.1 — indirect
grpc>1.16.0>console-control-strings@1.1.0 — indirect
grpc>1.16.0>core-util-is@1.0.2 — indirect
grpc>1.16.0>debug@2.6.9 — indirect
grpc>1.16.0>deep-extend@0.6.0 — indirect
grpc>1.16.0>delegates@1.0.0 — indirect
grpc>1.16.0>detect-libc@1.0.3 — indirect
grpc>1.16.0>fs-minipass@1.2.5 — indirect
grpc>1.16.0>fs.realpath@1.0.0 — indirect
grpc>1.16.0>gauge@2.7.4 — indirect
grpc>1.16.0>glob@7.1.2 — indirect
grpc>1.16.0>has-unicode@2.0.1 — indirect
grpc>1.16.0>iconv-lite@0.4.23 — indirect
grpc>1.16.0>ignore-walk@3.0.1 — indirect
grpc>1.16.0>inflight@1.0.6 — indirect
grpc>1.16.0>inherits@2.0.3 — indirect
grpc>1.16.0>ini@1.3.5 — indirect
grpc>1.16.0>is-fullwidth-code-point@1.0.0 — indirect
grpc>1.16.0>isarray@1.0.0 — indirect
grpc>1.16.0>minimatch@3.0.4 — indirect
grpc>1.16.0>minimist@1.2.0 — indirect
grpc>1.16.0>minipass@2.3.3 — indirect
grpc>1.16.0>minizlib@1.1.0 — indirect
grpc>1.16.0>mkdirp@0.5.1 — indirect
grpc>1.16.0>mkdirp>minimist@0.0.8 — indirect
grpc>1.16.0>ms@2.0.0 — indirect
grpc>1.16.0>needle@2.2.2 — indirect
grpc>1.16.0>node-pre-gyp@0.10.3 — indirect
grpc>1.16.0>nopt@4.0.1 — indirect
grpc>1.16.0>npm-bundled@1.0.3 — indirect
grpc>1.16.0>npm-packlist@1.1.11 — indirect
grpc>1.16.0>npmlog@4.1.2 — indirect
grpc>1.16.0>number-is-nan@1.0.1 — indirect
grpc>1.16.0>object-assign@4.1.1 — indirect
grpc>1.16.0>once@1.4.0 — indirect
grpc>1.16.0>os-homedir@1.0.2 — indirect
grpc>1.16.0>os-tmpdir@1.0.2 — indirect
grpc>1.16.0>osenv@0.1.5 — indirect
grpc>1.16.0>path-is-absolute@1.0.1 — indirect
grpc>1.16.0>process-nextick-args@2.0.0 — indirect
grpc>1.16.0>rc@1.2.8 — indirect
grpc>1.16.0>readable-stream@2.3.6 — indirect
grpc>1.16.0>rimraf@2.6.2 — indirect
grpc>1.16.0>safe-buffer@5.1.2 — indirect
grpc>1.16.0>safer-buffer@2.1.2 — indirect
grpc>1.16.0>sax@1.2.4 — indirect
grpc>1.16.0>semver@5.5.0 — indirect
grpc>1.16.0>set-blocking@2.0.0 — indirect
grpc>1.16.0>signal-exit@3.0.2 — indirect
grpc>1.16.0>string-width@1.0.2 — indirect
grpc>1.16.0>string_decoder@1.1.1 — indirect
grpc>1.16.0>strip-ansi@3.0.1 — indirect
grpc>1.16.0>strip-json-comments@2.0.1 — indirect
grpc>1.16.0>tar@4.4.6 — indirect
grpc>1.16.0>util-deprecate@1.0.2 — indirect
grpc>1.16.0>wide-align@1.1.3 — indirect
grpc>1.16.0>wrappy@1.0.2 — indirect
grpc>1.16.0>yallist@3.0.2 — indirect
http-parser-js@0.5.10 — indirect
iconv-lite@0.7.3 — indirect
inflight@1.0.6 — indirect
inherits@2.0.4 — indirect
invert-kv@1.0.0 — indirect
is-fullwidth-code-point@1.0.0 — indirect
is-stream@1.1.0 — indirect
isomorphic-fetch@2.2.1 — indirect
lcid@1.0.0 — indirect
lodash@4.18.1 — indirect
long@3.2.0 — indirect
minimatch@3.1.5 — indirect
nan@2.30.0 — indirect
node-fetch@1.7.3 — indirect
number-is-nan@1.0.1 — indirect
once@1.4.0 — indirect
optjs@3.2.2 — indirect
os-locale@1.4.0 — indirect
path-is-absolute@1.0.1 — indirect
promise-polyfill@7.1.2 — indirect
protobufjs@5.0.3 — indirect
safe-buffer@5.2.1 — indirect
safer-buffer@2.1.2 — indirect
string-width@1.0.2 — indirect
strip-ansi@3.0.1 — indirect
tslib@1.9.0 — indirect
websocket-driver@0.7.5 — indirect
websocket-extensions@0.1.4 — indirect
whatwg-fetch@2.0.4 — indirect
whatwg-fetch@3.6.20 — indirect
window-size@0.1.4 — indirect
wrap-ansi@2.1.0 — indirect
wrappy@1.0.2 — indirect
xmlhttprequest@1.8.0 — indirect
y18n@3.2.2 — indirect
yargs@3.32.0 — indirect

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

Known direct advisories

GHSA-3wf4-68gx-mph8

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Maintained	10/10 — 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review	8/10 — Found 24/27 approved changesets -- score normalized to 8
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Token-Permissions	7/10 — detected GitHub workflow tokens with excessive permissions
License	9/10 — license file detected
Binary-Artifacts	10/10 — no binaries found in the repo
Pinned-Dependencies	10/10 — all dependencies are pinned
Security-Policy	10/10 — security policy file detected
Branch-Protection	3/10 — branch protection is not maximal on development and all release branches
Fuzzing	0/10 — project is not fuzzed
SAST	7/10 — SAST tool is not run on all commits -- score normalized to 7

Evidence and freshness

https://registry.npmjs.org/firebase/5.5.9 — retrieved 2026-10-29T12:24:03.988Z
https://api.deps.dev/v3/projects/github.com%2Ffirebase%2Ffirebase-js-sdk — retrieved 2026-10-29T11:11:58.116Z
https://api.deps.dev/v3/systems/npm/packages/firebase/versions/5.5.9 — retrieved 2026-10-29T12:24:04.604Z
https://api.deps.dev/v3/systems/npm/packages/firebase/versions/5.5.9:dependencies — retrieved 2026-10-29T12:24:04.638Z