Main sync

.gitattributes

@@ -4,4 +4,11 @@
 
 # Isolate binary files in case the auto-detection algorithm fails and
 # marks them as text files (which could brick them).
-*.{png,jpg,jpeg,gif,webp,woff,woff2} binary
+*.{png,jpg,jpeg,gif,webp,woff,woff2} binary
+
+# Keep this branch's own copy of these files when syncing main into v5.
+# `.version` and README carry v5-specific content, so always keep ours.
+.version     merge=ours
+README.md    merge=ours
+# CHANGELOG gets release entries from main AND beta entries here — keep both.
+CHANGELOG.md merge=union

.github/workflows/codeql.yml

@@ -45,15 +45,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/test.yml

@@ -31,4 +31,4 @@ jobs:
 
       - run: ./gradlew testReleaseUnitTest jacocoTestReleaseUnitTestReport lintRelease --continue --console=plain
 
-      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # pin@7.0.0
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # pin@7.1.1

EXAMPLES.md

@@ -11,6 +11,7 @@ Each topic lives in its own file under [`examples/`](examples).
 - [Ephemeral Browsing](examples/ephemeral-browsing.md)
 - [Auth Tab](examples/auth-tab.md)
 - [DPoP](examples/dpop.md)
+- [Experiment Center](examples/experiment-center.md)
 - [Handling Configuration Changes During Authentication](examples/configuration-changes.md)
 
 ## Authentication API

build.gradle

@@ -42,4 +42,18 @@ allprojects {
         google()
         mavenCentral()
     }
+
+    // Patch vulnerable transitive deps to clear the reported CVEs. Pulled in by test
+    // tooling (netty-codec-http via AGP/grpc-netty, bcprov-jdk18on via Robolectric);
+    // not included in the published AAR.
+    configurations.configureEach {
+        resolutionStrategy.eachDependency { details ->
+            if (details.requested.group == 'io.netty' && details.requested.name == 'netty-codec-http') {
+                details.useVersion '4.1.137.Final'
+            }
+            if (details.requested.group == 'org.bouncycastle' && details.requested.name == 'bcprov-jdk18on') {
+                details.useVersion '1.85'
+            }
+        }
+    }
 }

examples/experiment-center.md

@@ -0,0 +1,54 @@
+# Experiment Center
+
+[Experiment Center](https://auth0.com/docs/customize/experiment-center/overview) is Auth0's A/B testing platform for authentication flows. It lets you split traffic across variants, measure results, and promote the winner — all inside Auth0.
+
+Pass `experiment_id`, `variation_id`, and optionally `segment_id` via `withParameters()` to force a user into a specific variation for the login request, bypassing the server-side deterministic assignment. All three IDs are obtained from your Auth0 Dashboard or the Management API:
+
+- `experiment_id` — the ID of the experiment to target
+- `variation_id` — the specific variation to assign to this user
+- `segment_id` — _(optional)_ restricts the override to a particular audience segment within the experiment
+
+```kotlin
+WebAuthProvider.login(account)
+    .withParameters(mapOf(
+        "experiment_id" to "<EXPERIMENT_ID>",
+        "variation_id" to "<VARIATION_ID>",
+        "segment_id" to "<SEGMENT_ID>"       // optional
+    ))
+    .start(this, callback)
+```
+
+<details>
+  <summary>Using coroutines</summary>
+
+```kotlin
+WebAuthProvider.login(account)
+    .withParameters(mapOf(
+        "experiment_id" to "<EXPERIMENT_ID>",
+        "variation_id" to "<VARIATION_ID>",
+        "segment_id" to "<SEGMENT_ID>"       // optional
+    ))
+    .await(this)
+```
+
+</details>
+
+<details>
+  <summary>Using Java</summary>
+
+```java
+WebAuthProvider.login(account)
+    .withParameters(new HashMap<String, Object>() {{
+        put("experiment_id", "<EXPERIMENT_ID>");
+        put("variation_id", "<VARIATION_ID>");
+        put("segment_id", "<SEGMENT_ID>");   // optional
+    }})
+    .start(this, callback);
+```
+
+</details>
+
+> [!NOTE]
+> Experiment Center is an Enterprise feature, and support via SDKs is currently in Early Access. To request access to this feature, contact your Auth0 representative. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions.
+>
+> Only `WebAuthProvider` login reaches Experiment Center. Embedded/native login and ROPG skip `/authorize` entirely and do not support experiment overrides.