Firebase CLI Docker image 15.22.0 fails in Cloud Build with FetchError: Premature close

[kei-creative-life]

[REQUIRED] Environment info

firebase-tools: 15.22.0
Official Docker image: us-docker.pkg.dev/firebase-cli/us/firebase:15.22.0

Platform: Cloud Build (Linux, official Firebase CLI Docker image)

[REQUIRED] Test case

Run a read-only Firebase Hosting command from Cloud Build using the official Firebase CLI Docker image.

No deploy command is required to reproduce this issue.

[REQUIRED] Steps to reproduce

Use a Cloud Build config like this, with a service account that has the required Firebase Hosting read permissions:

serviceAccount: "projects/<PROJECT_ID>/serviceAccounts/<SERVICE_ACCOUNT>"

steps:
  - name: "us-docker.pkg.dev/firebase-cli/us/firebase:15.21.0"
    entrypoint: "bash"
    args:
      - "-c"
      - |
        firebase --version
        firebase hosting:sites:list --project <PROJECT_ID> --debug

  - name: "us-docker.pkg.dev/firebase-cli/us/firebase:15.22.0"
    entrypoint: "bash"
    args:
      - "-c"
      - |
        firebase --version
        firebase hosting:sites:list --project <PROJECT_ID> --debug

options:
  logging: CLOUD_LOGGING_ONLY

[REQUIRED] Expected behavior

firebase hosting:sites:list --project <PROJECT_ID> --debug should successfully list Hosting sites, as it does with firebase-tools 15.21.0.

[REQUIRED] Actual behavior

With the same Cloud Build environment and same service account:

Image	Result
us-docker.pkg.dev/firebase-cli/us/firebase:15.21.0	Success
us-docker.pkg.dev/firebase-cli/us/firebase:15.22.0	Fails with FetchError: Premature close

Sanitized debug log excerpt from 15.21.0:

firebase --version
15.21.0

>>> [apiv2][query] GET https://firebasehosting.googleapis.com/v1beta1/projects/<PROJECT_ID>/sites pageToken=&pageSize=10
<<< [apiv2][status] GET https://firebasehosting.googleapis.com/v1beta1/projects/<PROJECT_ID>/sites 200

Sites for project <PROJECT_ID>

Sanitized debug log excerpt from 15.22.0:

firebase --version
15.22.0

[iam] error while checking permissions, command may fail:
FetchError: Invalid response body while trying to fetch
https://cloudresourcemanager.googleapis.com/v1/projects/<PROJECT_ID>:testIamPermissions:
Premature close

>>> [apiv2][query] GET https://firebasehosting.googleapis.com/v1beta1/projects/<PROJECT_ID>/sites pageToken=&pageSize=10

Error: FetchError: Invalid response body while trying to fetch
https://firebasehosting.googleapis.com/v1beta1/projects/<PROJECT_ID>/sites?pageToken=&pageSize=10:
Premature close

Additional investigation

This seems unrelated to Firebase Hosting deploy files, because the read-only hosting:sites:list command reproduces the issue.

The error appears while reading Google API responses in the official Docker image. The same command succeeds with 15.21.0 and fails with 15.22.0 under the same Cloud Build/service account conditions.

Looking at node-fetch, Premature close appears to be emitted when a chunked response without content-length is closed before the response body stream finishes. I am not sure whether the root cause is in the Docker image dependency set, Node/npm runtime, or something else in the 15.22.0 image, but the behavior started after moving from 15.21.0 to 15.22.0.

Workaround

Pin the Firebase CLI Docker image to 15.21.0 instead of using latest or 15.22.0.

[slaneyrw]

I'm seeing the same issue running the firebase cli directly in an Azure devops agent ( MS hosted ). However, downgrading NPM package to previous known working ( 15.20.0 ), or 15.21.0 has not resolved our issue.

Last known success 2026-06-17T12:20:49.84 Z
First known failure 2026-06-18T13:18:30.22 Z

[hiro-hori]

We can reproduce this consistently in GitHub Actions as well (not only Cloud Build).

• Auth method: Workload Identity Federation (google-github-actions/auth@v3)
• GOOGLE_APPLICATION_CREDENTIALS points to an external_account file (expected for WIF)
• gcloud auth application-default print-access-token succeeds
• But firebase-tools fails with FetchError: Premature close repeatedly, even with retries/backoff
• Downgrading did not help in our environment (15.22.0 -> 15.20.0 still fails)

So this does not look like broken credentials; it appears to be a runtime/network handling issue in the Firebase CLI request path in CI environments.

[kaldenswart]

Getting same issue in Cloud Build with 15.22.0. Using npm install firebase-tools@15.21.0 did not help, but changing image to "us-docker.pkg.dev/firebase-cli/us/firebase:15.21.0" worked perfectly.

[aalej]

Hey folks, thanks for reporting this issue. I think this could be related to #10681 - I'll reach out to engineering team so they can take a look.

Reading through the issue and comments, for now please use the "us-docker.pkg.dev/firebase-cli/us/firebase:15.21.0" image to work around the issue

[jdstaerk]

Hello, it is related to this issue: nodejs/node#63989.
Basically, the latest nodejs version breaks node-fetch@v2, which is used in the firebase-tools as a dependency.

[digitalkaoz]

confirmed, downgrading to node@24.16.0 works

[nicolassilvadev]

Confirmed - in our case downgrading to node@22.22.3 fixed it.