sync : Sync main to v5_developement by pmathew92 · Pull Request #1105 · auth0/Auth0.Android

pmathew92 · 2026-10-23T06:58:26Z

Changes

This PR brings the current changes in main to the v5_developement branch

Checklist

I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors

Summary by CodeRabbit

New Features
- Added beta embedded authentication flows for email and phone OTP, push approval, recovery codes, and TOTP, with typed errors and session-aware continuation.
- Added an interactive sample app demonstrating embedded authentication.
Documentation
- Added setup guidance and examples for embedded authentication and its supported factors.
Chores
- Updated the SDK version to 5.0.0-beta.0 and expanded CI triggers to include the development branch.

Bumps the codeql group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/autobuild` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql - dependency-name: github/codeql-action/autobuild dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql ... Signed-off-by: dependabot[bot] <support@github.com>

… Keystore2 Port of #1048 from release/3.x. Dropped the API < 23 KeyPairGeneratorSpec branch (not present on main) and migrated the new test from PowerMockito to Mockito. (cherry picked from commit fcb50ee)

… Keystore2 (#1092)

- Add PasskeyVerificationMethod and use it for verification codes and identifiers - Retryable when invalid_grant has auth_session, or invalid_request for a missing/empty code - Reject blank verification codes before the network call - verification defaults to emptyMap; verificationRequired defaults to an empty list - Reuse passwordless.DeliveryMethod instead of PasskeyDeliveryMethod - Treat HTTP 429 as isTooManyAttempts; remove isTooManyRequests - Add mfa_required test; update passkey docs Co-Authored-By: Claude

Co-Authored-By: Claude <noreply@anthropic.com>

…er-verification

- Retryable when invalid_grant or invalid_request carries an auth_session - PasskeyVerificationMethod is a plain enum; verificationRequired is nullable - Map plain-text 429 to too_many_attempts; keep isTooManyAttempts code-only - Validate blank codes before serializing; reuse the client gson - Update passkey docs and tests Co-Authored-By: Claude

Not every 429 means too_many_attempts. Keep isTooManyAttempts and the plain-text error code unchanged from main, and document checking statusCode == 429 for the signupWithPasskey rate limit. Co-Authored-By: Claude

- Send verification codes as-is; the server reports missing/empty codes - passkeyVerificationRequired is only set for invalid_grant - Docs: describe the two retryable cases, drop the rate-limit note Co-Authored-By: Claude

…-java group (#1097) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

Co-authored-by: Claude <noreply@anthropic.com>

- Add signinWithPasskey(challenge, ...) that checks codes against verificationRequired before sending, and only sends the required ones - Fail locally with an invalid_request shaped like the server error for an empty map, a missing identifier, or an empty or whitespace-only code - Only invalid_grant with auth_session is retryable for now - Update KDoc, tests and passkey docs Co-Authored-By: Claude

- Report the first required identifier without a code, including for an empty map - Only reject empty codes; send whitespace codes and non-required codes as given - Local error carries only error and error_description Co-Authored-By: Claude

…er-verification

- Remove signinWithPasskey(challenge, ...) - Add verificationRequired (default empty) to the signinWithPasskey overloads; the codes are checked against it before sending - Update tests and passkey docs Co-Authored-By: Claude

Co-Authored-By: Claude

…6-10-23

coderabbitai · 2026-10-23T06:58:43Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Team
Run ID: 1e2acdb3-dcf6-4d5b-b47b-b4c2105bff97

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

utkrishtsahu and others added 26 commits October 9, 2026 15:30

feat: add passkey identifier verification support

9478b7a

chore(deps): bump the codeql group with 3 updates (#1089)

030b6c2

fix(storage): authorize MGF1 digest to prevent INCOMPATIBLE_DEVICE on…

68df2f5

… Keystore2 Port of #1048 from release/3.x. Dropped the API < 23 KeyPairGeneratorSpec branch (not present on main) and migrated the new test from PowerMockito to Mockito. (cherry picked from commit fcb50ee)

docs(changelog): retain 3.21.1-beta.0 and 3.21.1 release history

17b542f

fix(storage): authorize MGF1 digest to prevent INCOMPATIBLE_DEVICE on…

06b07fa

… Keystore2 (#1092)

docs(passkey): reword verification intro, declare retry limit

d62794c

Co-Authored-By: Claude <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into feat/passkey-identifi…

22de92b

…er-verification

fix(passkey): revert 429 mapping to too_many_attempts

73836f4

Not every 429 means too_many_attempts. Keep isTooManyAttempts and the plain-text error code unchanged from main, and document checking statusCode == 429 for the signupWithPasskey rate limit. Co-Authored-By: Claude

fix(passkey): drop client-side code check, clarify retry cases

3a2c775

- Send verification codes as-is; the server reports missing/empty codes - passkeyVerificationRequired is only set for invalid_grant - Docs: describe the two retryable cases, drop the rate-limit note Co-Authored-By: Claude

chore(deps): bump actions/setup-java from 6.0.1 to 6.1.0 in the setup…

df60ab4

…-java group (#1097) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump the codeql group with 3 updates (#1096)

3165d27

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

fix: stop reporting an unrecognized biometric as a final failure (#1100)

acf4068

Co-authored-by: Claude <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into feat/passkey-identifi…

480e74a

…er-verification

refactor(passkey): reuse gson and move private helper to the bottom

83316ef

Co-Authored-By: Claude

fix(passkey): treat whitespace-only verification codes as empty

7dd83af

Co-Authored-By: Claude

feat: add passkey identifier verification support (#1087)

b9c04ee

Release 4.2.0

418ebe7

Release 4.2.0 (#1104)

42ac50f

fix: keep scope case when appending the openid scope (#1102)

d28b1ea

Merge remote-tracking branch 'origin/main' into sync/main-into-v5-202…

f52bbf1

…6-10-23

pmathew92 requested a review from a team as a code owner October 23, 2026 06:58

pmathew92 changed the base branch from main to v5_development October 23, 2026 06:59

NandanPrabhu approved these changes Oct 23, 2026

View reviewed changes

pmathew92 merged commit 4a188d0 into v5_development Oct 23, 2026
7 checks passed

pmathew92 deleted the sync/main_v5 branch October 23, 2026 07:19

eduardo-santos-tribia mentioned this pull request Oct 23, 2026

Android: users are logged out after updating to 5.11.2 or 5.11.3 from react-native-auth0 5.4.0 or older auth0/react-native-auth0#1696

Open

6 tasks done

Navigation Menu

Repository navigation

sync : Sync main to v5_developement - #1105

sync : Sync main to v5_developement#1105
pmathew92 merged 26 commits into
v5_developmentfrom
sync/main_v5

pmathew92 commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

pmathew92 commented Oct 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pmathew92 commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading