Runtime update policy is not configurable through Firebase deploy for existing 2nd gen functions #11330

I am not sure whether this is intentional preservation behavior or a missing Firebase deployment feature. I would like to clarify the intended behavior before proposing an implementation.

[REQUIRED] Environment info

firebase-tools: 15.14.0

I also checked the current 15.16.0 implementation and could not find support for automaticUpdatePolicy, onDeployUpdatePolicy, or a runtime update policy setting.

Platform: macOS 26.5.2, arm64

[REQUIRED] Test case

Deploy a 2nd gen Firebase Function which currently uses the "on deployment" runtime update policy.

Minimal function:

const { onRequest } = require("firebase-functions/v2/https");

exports.hello = onRequest((_req, res) => {
  res.send("Hello");
});

{
  "engines": {
    "node": "24"
  },
  "dependencies": {
    "firebase-functions": "^7.2.5"
  }
}

The existing function has the following Cloud Functions v2 configuration:

buildConfig:
  onDeployUpdatePolicy:
    runtimeVersion: ...
  runtime: nodejs24

Its underlying Cloud Run service has:

run.googleapis.com/build-enable-automatic-updates: "false"

[REQUIRED] Steps to reproduce

1. Start with an existing 2nd gen Firebase Function whose runtime update policy is on-deploy.

2. Deploy it with the Firebase CLI:

   firebase deploy --only functions:hello

3. Inspect the function:

   gcloud functions describe hello \
     --gen2 \
     --region=us-central1 \
     --format="yaml(buildConfig.runtime,buildConfig.automaticUpdatePolicy,buildConfig.onDeployUpdatePolicy)"

4. Inspect the underlying Cloud Run service:

   gcloud run services describe hello \
     --region=us-central1 \
     --format="yaml(metadata.annotations.run.googleapis.com/build-enable-automatic-updates)"

[REQUIRED] Expected behavior

It should either be possible to declaratively select the runtime/base image update policy through the Firebase deployment configuration, or the documentation should make clear that this policy is intentionally outside Firebase's configuration model and must be managed separately.

If Firebase is intended to manage this setting, one possible API would be a firebase.json option such as:

{
  "functions": {
    "runtimeUpdatePolicy": "automatic"
  }
}

The Firebase CLI would map this to the Cloud Functions v2 API:

{
  "buildConfig": {
    "automaticUpdatePolicy": {}
  }
}

and include the corresponding field in the update mask.

Supporting both values would allow users to make the intended policy explicit:

• automatic
• on-deploy

For backward compatibility, the behavior when the setting is omitted could continue to preserve the deployed policy. Alternatively, the CLI could warn when an existing function has automatic security updates disabled.

I am not proposing that Firebase silently migrate every existing function to automatic. The open question is whether the current preservation behavior is intentional and, if so, how users are expected to manage this security-relevant setting alongside Firebase deployments.

[REQUIRED] Actual behavior

firebase deploy updates the function but leaves the existing runtime update policy unchanged:

buildConfig:
  onDeployUpdatePolicy:
    runtimeVersion: ...

The underlying Cloud Run service continues to report:

run.googleapis.com/build-enable-automatic-updates: "false"

Newer functions in the same project may use automatic updates by default, while older functions remain on the on-deploy policy. This can leave a single Firebase project with a mixture of update policies even after all functions are deployed by the same Firebase CLI workflow.

There is currently no Firebase Functions runtime option or firebase.json setting that can make this policy explicit. Users must manage it separately through Google Cloud tooling. It is unclear whether this is an intentional boundary of Firebase deployment management or an unsupported Cloud Functions v2 field.

Google Cloud documents automatic updates as the default and exposes automaticUpdatePolicy / onDeployUpdatePolicy through the Cloud Functions v2 API:

• https://cloud.google.com/functions/docs/securing/execution-environment-security
• https://cloud.google.com/functions/docs/reference/rest/v2/projects.locations.functions