@firebase/firestore

@firebase/firestore 4.17.2 appears to be a highly mature and actively maintained release. It has nearly nine years of release history, 127 releases in the last 12 months, a non-deprecated stable-major version, extensive type declarations, tests, a substantial package and repository tree, and strong recent repository activity from 15 active maintainers. The Firebase organization provides meaningful project backing, the repository is active and unarchived, and its workflows show no analyzed dangerous patterns. The main limitations are absent build provenance attestation, incomplete top-level workflow permission declarations in five workflows, and no detected security-scanning tooling; these reduce transparency and defense-in-depth but do not outweigh the strong maintenance and backing evidence.

Latest 4.17.2

NPM

92%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

No build attestation, trusted publisher identity, or staged-publishing evidence was detected, leaving release-to-source provenance less transparent.

Repo tooling

The repository uses established build tools including Nx, Rollup, Webpack, TypeScript, and Babel, but no security-scanning tools were detected, leaving a defense-in-depth gap.

Token permissions

Sixteen workflows declare read-only permissions and none declare top-level write permissions, but five workflows lack top-level permissions declarations, reducing permission clarity.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
re2js Version ^2.8.3	—	—
tslib Version ^2.1.0	—	—
@grpc/grpc-js Version ~1.9.0	—	—
@firebase/util Version 1.15.3	—	—
@firebase/logger Version 0.5.2	—	—