Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: firebase/firebase-cpp-sdk
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: firebase/firebase-cpp-sdk
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: ab-update-ssl-deps
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 3 commits
  • 23 files changed
  • 1 contributor

Commits on Oct 23, 2026

  1. Update SSL/TLS and networking dependencies to latest (BoringSSL, curl… 

    …, uWebSockets, OpenSSL)

- Update BoringSSL from fips-20220613 to fips-20260721.
- Update BoringSSL MSVC warnings patch for fips-20260721.
- Update CMakeLists.txt and package.sh for BoringSSL root build directory output flattening.
- Update libcurl from 7_73_0 to 8_23_0, configure modern CMake static options, disable unused optional dependencies, enable Apple SecTrust on macOS for native certificate verification, and update app/rest/CMakeLists.txt for libcurl_static alias target.
- Update uWebSockets to v0.14.8 (commit 6d80b42e).
- Patch uWebSockets to enable SSL_VERIFY_PEER, load system trusted CA roots on Linux, macOS, and Windows, and enforce RFC 6125 hostname verification on desktop client wss connections. Link crypt32 for libuWS on MSVC.
- Update Windows OpenSSL Chocolatey install pin from 3.1.1 to 3.6.2 in install_prereqs_desktop.py.
    @AustinBenoit
    AustinBenoit committed Oct 23, 2026
    Configuration menu
    Copy the full SHA
    c41ffc4 View commit details
    Browse the repository at this point in the history

  2. Verify TLS certificates for Realtime Database desktop connections; up… 

    …date zlib, libuv, googletest

Realtime Database (desktop) connects to Firebase over wss:// through
uWebSockets, which creates its client SSL_CTX with certificate
verification disabled, so any certificate was accepted. This change adds
WebSocketHub, a uWS::Hub subclass owned by the SDK that configures that
SSL_CTX to:
  * require TLS 1.2 or newer,
  * verify the server's chain against the operating system's trusted
    roots (Windows "ROOT" store; macOS system roots plus admin/user trust
    settings; Linux distro CA bundle and SSL_CERT_FILE/SSL_CERT_DIR), and
  * require the leaf certificate to match the connection host per
    RFC 6125 (subjectAltName only, no partial wildcards).
Rejections are logged with the X.509 error and the connection surfaces as
a connection error. The trusted roots are loaded once per process and
shared between hubs. Connections fail closed if the host is unknown.

Doing this in SDK code lets the uWebSockets patch shrink back to the two
original fixes, rebased onto v0.14.8.

Tests: unit tests for host extraction and SSL_CTX configuration, plus
in-process TLS handshakes over a BIO pair with a certificate generated at
test time covering untrusted root, hostname mismatch, multi-label
wildcard, CN-only match, IP subjectAltName and unknown-host rejection.

Dependency updates:
  * zlib 1.2.11 -> 1.3.2 (fixes CVE-2018-25032, CVE-2022-37434)
  * libuv v1.33.1 -> v1.53.0 (static library is now libuv.a/libuv.lib;
    Windows now also links dbghelp, ole32, synchronization)
  * googletest 1.11.0 -> 1.18.0 (integration tests keep their
    deliberately pinned 1.11.0)
Also replaces deprecated libcurl APIs (CURLOPT_PROTOCOLS,
CURLINFO_*_UPLOAD/DOWNLOAD) with their current equivalents, and fixes
cmake/external/leveldb.cmake applying a stale `patch_file` from
boringssl.cmake on non-MSVC platforms.
    @AustinBenoit
    AustinBenoit committed Oct 23, 2026
    Configuration menu
    Copy the full SHA
    ead295e View commit details
    Browse the repository at this point in the history

  3. Remove the uWebSockets patch by fixing its root cause in WebSocketHub 

    The patch carried two hunks:

* Socket.h: retry SSL_write in a loop on SSL_ERROR_WANT_WRITE (#344). The
  underlying crash is that uWS::Hub::connect() gives sockets the
  Group<CLIENT> copy of NodeData, whose `tid` still names the thread that
  constructed the Hub because uS::Node::run() only updates the original.
  On the libuv backend (macOS, Windows) Socket::changePoll() then takes
  the cross-thread path through an Async the copy never created and
  dereferences null the first time a write has to wait. The patch only
  avoided this for the SSL WANT_WRITE case (by spinning); plaintext
  partial sends and WANT_READ hit the same pointer. WebSocketHub::run()
  now records the loop thread in the Group copies before running the
  loop, so every poll change stays on the direct path.

* HTTPSocket.h: sprintf -> snprintf to silence a deprecation warning in
  server-side code the SDK never calls. macOS desktop builds already pass
  -Wno-deprecated-declarations globally; the uWebSockets include
  directory is now a SYSTEM include for firebase_database and its tests
  so warnings from its headers are not reported against SDK sources on
  any compiler.

uWebSockets is now consumed unmodified at v0.14.8. Adds a regression
test that sends an 8 MiB message through the local echo server, which
exercises the queued-write path on every platform.
    @AustinBenoit
    AustinBenoit committed Oct 23, 2026
    Configuration menu
    Copy the full SHA
    4f25e2c View commit details
    Browse the repository at this point in the history
Loading