Crashlytics traces2

[MaesterChestnut]

Hey there! So you want to contribute to a Firebase SDK?
Before you file this pull request, please read these guidelines:

Discussion

• Read the contribution guidelines (CONTRIBUTING.md).
• If this has been discussed in an issue, make sure to link to the issue here.
  If not, go file an issue about this before creating a pull request to discuss.

Testing

• Make sure all existing tests in the repository pass after your change.
• If you fixed a bug or added a feature, add a new test to cover your code.

API Changes

• Changes that affect the public API will require internal review. Before making a
  PR that changes the public API, we would suggest first proposing your change in an
  issue so that we can discuss it together.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 98382d1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	2  7
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	6
Software Management Findings	-
Total	2  13

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces navigation tracking for Next.js and Angular, adds tracing support, and updates various dependencies. The review identified several areas for improvement, including potential WebSocket connection churn due to immediate idle timeouts, heuristic limitations in route pattern matching, inefficient useEffect dependency arrays, missing type handling for keepalive payloads, potential global unregistration issues in CrashlyticsService, and missing dependencies in React useEffect hooks.

[gemini-code-assist]

Immediate close of idle connections (IDLE_CONNECTION_TIMEOUT_MS = 0) can lead to severe WebSocket connection churn in single-page applications. When a user navigates between pages, subscriptions are often torn down and recreated in rapid succession. Closing the connection immediately means every such transition will require a full WebSocket handshake, increasing latency for the user and load on the server. Consider keeping a short grace period (e.g., a few seconds) instead of closing immediately.

[gemini-code-assist]

This heuristic replacement can incorrectly replace static path segments if a parameter's value happens to match a static segment earlier in the pathname. For example, for a path /posts/edit/edit where id = 'edit', the first static /edit will be replaced, resulting in /posts/:id/edit instead of /posts/edit/:id. While Next.js client-side navigation doesn't easily expose the raw route template, we should document this limitation or consider if there's a more robust way to match parameters (e.g., matching from right to left or checking parameter position if possible).

[gemini-code-assist]

The useEffect dependency array contains [pathname, params], but params is an object returned by useParams(). If its reference changes on render (even if values are identical), the effect will re-run. Since pattern is a stable string derived from pathname and params, and both crashlytics and pattern are used inside the effect, it is more efficient and correct to use [crashlytics, pattern] as the dependency array.

  useEffect(() => {\n    logViewBoundary(crashlytics, pattern);\n  }, [crashlytics, pattern]);

[gemini-code-assist]

The data payload sent to the transport can be a string or a Uint8Array. If data is a string, data.byteLength will be undefined, which makes keepalive evaluate to false regardless of the payload size. To support keepalive for string payloads, we should handle both types.

      const byteLength = typeof data === 'string' ? new TextEncoder().encode(data).length : data.byteLength;\n      const keepalive = byteLength < KEEPALIVE_MAX_PAYLOAD_SIZE;

[gemini-code-assist]

Since CrashlyticsService supports multiple instances (setMultipleInstances(true)), calling _delete() on one instance will globally unregister the instrumentations for all instances via unregisterLoggerInstrumentations() and unregisterTracingInstrumentations(). If other instances are still active, they will lose automatic tracing and logging. Consider using a reference counter or tracking active instances to only unregister when the last instance is deleted.

[gemini-code-assist]

If crashlyticsOptions is passed as an inline object (e.g., <FirebaseCrashlytics crashlyticsOptions={{...}} />), its reference will change on every render. Since React's useEffect dependency check is shallow, this effect will re-run on every render, repeatedly adding and removing global window error listeners. Consider deeply comparing or memoizing crashlyticsOptions before using it in the dependency array, or using a ref to store the options.

[gemini-code-assist]

The React.useEffect uses crashlytics and pattern inside the effect, but the dependency array is [location.key]. To be compliant with react-hooks/exhaustive-deps and ensure the effect re-runs if the crashlytics instance or pattern changes, they should be included in the dependency array.

  React.useEffect(() => {\n    logViewBoundary(crashlytics, pattern);\n  }, [crashlytics, pattern, location.key]);