cynthiajoan · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,37 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 2026-10-23 - [BoM 4.20.2](https://github.com/firebase/flutterfire/blob/main/VERSIONS.md#flutter-bom-4202-2026-10-23)
+
+### Changes
+
+> Note: This is a security release for Cloud Firestore on Windows. Firebase C++ SDK 13.13.1 builds Firestore from Firebase iOS SDK 12.19.3, which removes compromised eMudhra CA roots from Firestore's embedded gRPC root-certificate bundle ([firebase-ios-sdk#16930](https://github.com/firebase/firebase-ios-sdk/pull/16930)).
+>
+> - **Windows**: upgrade to this `firebase_core` release (or `cloud_firestore` 6.10.2, which requires it). If the build keeps using the old SDK, run `flutter clean`. If you set `FIREBASE_CPP_SDK_DIR`, point it at a 13.13.1 SDK.
+> - iOS/macOS were fixed in `firebase_core` 4.15.1 (BoM 4.20.1).
+
+---
+
+Packages with breaking changes:
+
+ - There are no breaking changes in this release.
+
+Packages with other changes:
+
+ - [`cloud_firestore` - `v6.10.2`](#cloud_firestore---v6102)
+ - [`firebase_core` - `v4.15.2`](#firebase_core---v4152)
+
+---
+
+#### `cloud_firestore` - `v6.10.2`
+
+ - Bump "cloud_firestore" to `6.10.2`.
+
+#### `firebase_core` - `v4.15.2`
+
+ - **FIX**(core): bump Firebase C++ SDK to 13.13.1 (4.x backport, Windows Firestore security fix) ([#18868](https://github.com/firebase/flutterfire/issues/18868)). ([1ae6803a](https://github.com/firebase/flutterfire/commit/1ae6803a7abfa1bf5122647ccdd24087ee2b3a17))
+
+
 ## 2026-10-23 - [BoM 4.20.1](https://github.com/firebase/flutterfire/blob/main/VERSIONS.md#flutter-bom-4201-2026-10-23)
 
 ### Changes

diff --git a/VERSIONS.md b/VERSIONS.md
@@ -4,6 +4,44 @@ This document is listing all the compatible versions of the FlutterFire plugins.
 
 # Versions
 
+## [Flutter BoM 4.20.2 (2026-10-23)](https://github.com/firebase/flutterfire/blob/main/CHANGELOG.md#2026-10-23)
+
+Install this version using FlutterFire CLI
+
+```bash
+flutterfire install 4.20.2
+```
+
+### Included Native Firebase SDK Versions
+| Firebase SDK | Version | Link |
+|--------------|---------|------|
+| Android SDK | 34.19.0 | [Release Notes](https://firebase.google.com/support/release-notes/android) |
+| iOS SDK | 12.19.3 | [Release Notes](https://firebase.google.com/support/release-notes/ios) |
+| Web SDK | 12.19.0 | [Release Notes](https://firebase.google.com/support/release-notes/js) |
+| Windows SDK | 13.13.1 | [Release Notes](https://firebase.google.com/support/release-notes/cpp-relnotes) |
+
+### FlutterFire Plugin Versions
+| Plugin | Version | Dart Version | Flutter Version |
+|--------|---------|--------------|-----------------|
+| [cloud_firestore](https://pub.dev/packages/cloud_firestore/versions/6.10.2) | 6.10.2 | ^3.6.0 | >=3.27.0 |
+| [cloud_functions](https://pub.dev/packages/cloud_functions/versions/6.5.1) | 6.5.1 | ^3.6.0 | >=3.27.0 |
+| [firebase_ai](https://pub.dev/packages/firebase_ai/versions/4.0.0) | 4.0.0 | ^3.6.0 | >=3.16.0 |
+| [firebase_analytics](https://pub.dev/packages/firebase_analytics/versions/12.6.1) | 12.6.1 | ^3.6.0 | >=3.27.0 |
+| [firebase_app_check](https://pub.dev/packages/firebase_app_check/versions/0.4.9) | 0.4.9 | ^3.6.0 | >=3.27.0 |
+| [firebase_app_installations](https://pub.dev/packages/firebase_app_installations/versions/0.4.5) | 0.4.5 | ^3.6.0 | >=3.27.0 |
+| [firebase_auth](https://pub.dev/packages/firebase_auth/versions/6.7.1) | 6.7.1 | ^3.6.0 | >=3.16.0 |
+| [firebase_core](https://pub.dev/packages/firebase_core/versions/4.15.2) | 4.15.2 | ^3.6.0 | >=3.27.0 |
+| [firebase_crashlytics](https://pub.dev/packages/firebase_crashlytics/versions/5.4.1) | 5.4.1 | ^3.6.0 | >=3.27.0 |
+| [firebase_data_connect](https://pub.dev/packages/firebase_data_connect/versions/0.3.3) | 0.3.3 | ^3.6.0 | >=3.27.0 |
+| [firebase_database](https://pub.dev/packages/firebase_database/versions/12.6.1) | 12.6.1 | ^3.6.0 | >=3.27.0 |
+| [firebase_in_app_messaging](https://pub.dev/packages/firebase_in_app_messaging/versions/0.9.5) | 0.9.5 | ^3.6.0 | >=3.27.0 |
+| [firebase_messaging](https://pub.dev/packages/firebase_messaging/versions/16.7.1) | 16.7.1 | ^3.6.0 | >=3.27.0 |
+| [firebase_ml_model_downloader](https://pub.dev/packages/firebase_ml_model_downloader/versions/0.4.6) | 0.4.6 | ^3.6.0 | >=3.27.0 |
+| [firebase_performance](https://pub.dev/packages/firebase_performance/versions/0.11.7) | 0.11.7 | ^3.6.0 | >=3.27.0 |
+| [firebase_remote_config](https://pub.dev/packages/firebase_remote_config/versions/6.7.1) | 6.7.1 | ^3.6.0 | >=3.27.0 |
+| [firebase_storage](https://pub.dev/packages/firebase_storage/versions/13.6.1) | 13.6.1 | ^3.6.0 | >=3.27.0 |
+
+
 ## [Flutter BoM 4.20.1 (2026-10-23)](https://github.com/firebase/flutterfire/blob/main/CHANGELOG.md#2026-10-23)
 
 Install this version using FlutterFire CLI

diff --git a/packages/cloud_firestore/cloud_firestore/CHANGELOG.md b/packages/cloud_firestore/cloud_firestore/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 6.10.2
+
+ - **FIX**(firestore,windows): require `firebase_core` ^4.15.2 so Windows builds use Firebase C++ SDK 13.13.1 (Firestore security fix).
+
 ## 6.10.1
 
  - **FIX**(core): bump Firebase iOS SDK to 12.19.3 (4.x backport, Firestore security fix) ([#18861](https://github.com/firebase/flutterfire/issues/18861)). ([ff334acb](https://github.com/firebase/flutterfire/commit/ff334acbf5a87a94f33f9d59319d93cee576d2e7))

diff --git a/packages/cloud_firestore/cloud_firestore/ios/cloud_firestore/Package.swift b/packages/cloud_firestore/cloud_firestore/ios/cloud_firestore/Package.swift
@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let libraryVersion = "6.10.1"
+let libraryVersion = "6.10.2"
 let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(

diff --git a/packages/cloud_firestore/cloud_firestore/macos/cloud_firestore/Package.swift b/packages/cloud_firestore/cloud_firestore/macos/cloud_firestore/Package.swift
@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let libraryVersion = "6.10.1"
+let libraryVersion = "6.10.2"
 let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(

diff --git a/packages/cloud_firestore/cloud_firestore/pubspec.yaml b/packages/cloud_firestore/cloud_firestore/pubspec.yaml
@@ -4,7 +4,7 @@ description:
   live synchronization and offline support on Android and iOS.
 homepage: https://firebase.google.com/docs/firestore
 repository: https://github.com/firebase/flutterfire/tree/main/packages/cloud_firestore/cloud_firestore
-version: 6.10.1
+version: 6.10.2
 resolution: workspace
 topics:
   - firebase
@@ -24,7 +24,7 @@ dependencies:
   cloud_firestore_platform_interface: ^8.0.7
   cloud_firestore_web: ^5.7.3
   collection: ^1.0.0
-  firebase_core: ^4.15.1
+  firebase_core: ^4.15.2
   firebase_core_platform_interface: ^8.1.1
   flutter:
     sdk: flutter

diff --git a/packages/cloud_firestore/cloud_firestore_web/lib/src/cloud_firestore_version.dart b/packages/cloud_firestore/cloud_firestore_web/lib/src/cloud_firestore_version.dart
@@ -13,4 +13,4 @@
 // limitations under the License.
 
 /// generated version number for the package, do not manually edit
-const packageVersion = '6.10.1';
+const packageVersion = '6.10.2';
diff --git a/packages/firebase_core/firebase_core/CHANGELOG.md b/packages/firebase_core/firebase_core/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 4.15.2
+
+> Note: This is a security release for Cloud Firestore on Windows. Firebase C++ SDK 13.13.1 builds Firestore from Firebase iOS SDK 12.19.3, which removes compromised eMudhra CA roots from Firestore's embedded gRPC root-certificate bundle ([firebase-ios-sdk#16930](https://github.com/firebase/firebase-ios-sdk/pull/16930)).
+>
+> - **Windows**: upgrade to this `firebase_core` release (or `cloud_firestore` 6.10.2, which requires it). If the build keeps using the old SDK, run `flutter clean`. If you set `FIREBASE_CPP_SDK_DIR`, point it at a 13.13.1 SDK.
+> - iOS/macOS were fixed in `firebase_core` 4.15.1 (BoM 4.20.1).
+
+ - **FIX**(core): bump Firebase C++ SDK to 13.13.1 (4.x backport, Windows Firestore security fix) ([#18868](https://github.com/firebase/flutterfire/issues/18868)). ([1ae6803a](https://github.com/firebase/flutterfire/commit/1ae6803a7abfa1bf5122647ccdd24087ee2b3a17))
+
 ## 4.15.1
 
 > Note: This is a security release for Cloud Firestore on iOS and macOS. Firebase iOS SDK 12.19.3 removes compromised eMudhra CA roots from Firestore's embedded gRPC root-certificate bundle ([firebase-ios-sdk#16930](https://github.com/firebase/firebase-ios-sdk/pull/16930)). CocoaPods and Swift Package Manager both now use 12.19.3.

diff --git a/packages/firebase_core/firebase_core/ios/firebase_core/Package.swift b/packages/firebase_core/firebase_core/ios/firebase_core/Package.swift
@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let libraryVersionString = "4.15.1"
+let libraryVersionString = "4.15.2"
 let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(

diff --git a/packages/firebase_core/firebase_core/ios/firebase_core/Sources/firebase_core/Constants.swift b/packages/firebase_core/firebase_core/ios/firebase_core/Sources/firebase_core/Constants.swift
@@ -3,4 +3,4 @@
 // found in the LICENSE file.
 
 /// Auto-generated file. Do not edit.
-public let versionNumber = "4.15.1"
+public let versionNumber = "4.15.2"
diff --git a/packages/firebase_core/firebase_core/macos/firebase_core/Package.swift b/packages/firebase_core/firebase_core/macos/firebase_core/Package.swift
@@ -7,7 +7,7 @@
 
 import PackageDescription
 
-let libraryVersionString = "4.15.1"
+let libraryVersionString = "4.15.2"
 let firebaseSdkVersion: Version = "12.19.3"
 
 let package = Package(

diff --git a/packages/firebase_core/firebase_core/pubspec.yaml b/packages/firebase_core/firebase_core/pubspec.yaml
@@ -3,7 +3,7 @@ description: Flutter plugin for Firebase Core, enabling connecting to multiple
   Firebase apps.
 homepage: https://firebase.google.com/docs/flutter/setup
 repository: https://github.com/firebase/flutterfire/tree/main/packages/firebase_core/firebase_core
-version: 4.15.1
+version: 4.15.2
 resolution: workspace
 topics:
   - firebase

diff --git a/packages/firebase_core/firebase_core_web/lib/src/firebase_core_version.dart b/packages/firebase_core/firebase_core_web/lib/src/firebase_core_version.dart
@@ -13,4 +13,4 @@
 // limitations under the License.
 
 /// generated version number for the package, do not manually edit
-const packageVersion = '4.15.1';
+const packageVersion = '4.15.2';
diff --git a/scripts/versions.json b/scripts/versions.json
@@ -1,4 +1,32 @@
 {
+  "4.20.2": {
+    "date": "2026-10-23",
+    "firebase_sdk": {
+      "android": "34.19.0",
+      "ios": "12.19.3",
+      "web": "12.19.0",
+      "windows": "13.13.1"
+    },
+    "packages": {
+      "cloud_firestore": "6.10.2",
+      "cloud_functions": "6.5.1",
+      "firebase_ai": "4.0.0",
+      "firebase_analytics": "12.6.1",
+      "firebase_app_check": "0.4.9",
+      "firebase_app_installations": "0.4.5",
+      "firebase_auth": "6.7.1",
+      "firebase_core": "4.15.2",
+      "firebase_crashlytics": "5.4.1",
+      "firebase_data_connect": "0.3.3",
+      "firebase_database": "12.6.1",
+      "firebase_in_app_messaging": "0.9.5",
+      "firebase_messaging": "16.7.1",
+      "firebase_ml_model_downloader": "0.4.6",
+      "firebase_performance": "0.11.7",
+      "firebase_remote_config": "6.7.1",
+      "firebase_storage": "13.6.1"
+    }
+  },
   "4.20.1": {
     "date": "2026-10-23",
     "firebase_sdk": {