[utkrishtsahu]

📋 Changes

Bumps the native and web SDK dependencies ahead of 3.x GA.

⚠️ Breaking (requirements): Auth0.swift 3.1.0+ raised its minimum deployment targets, so this PR raises auth0_flutter's minimums from iOS 14 / macOS 11 to iOS 15 / macOS 12. There are no public Dart API changes and no Flutter plugin source changes.

SDK	From	To	Files
Auth0.Android	4.1.0	4.2.0	auth0_flutter/android/build.gradle
Auth0.swift	3.0.2	3.2.0	auth0_flutter/darwin/auth0_flutter.podspec, auth0_flutter/darwin/auth0_flutter/Package.swift, auth0_flutter/ios/auth0_flutter.podspec, auth0_flutter/macos/auth0_flutter.podspec
auth0-spa-js	2.24	2.29	auth0_flutter/README.md (CDN script tag, /2.29/), auth0_flutter/example/web/index.html (@2.29.0)

JWTDecode (4.0.0) and SimpleKeychain (1.3.0) are unchanged; they already match what Auth0.swift 3.2.0 requires.

Why:

• Auth0.Android 4.2.0 includes two fixes that are not in 4.1.0 (the version currently on develop/v3.0) and that 3.x GA should ship with:

  • Stops reporting an unrecognized biometric as a final failure (#1100). Before this fix, credentials() with localAuthentication could fail even when the user then authenticated successfully.
  • Authorizes MGF1 digests to prevent INCOMPATIBLE_DEVICE when saving credentials on newer Keystore2 hardware (Android 16+) (#1092).

  The 2.x line already has both: Auth0.Android 3.21.1 (MGF1, #1048) and 3.21.2 (biometric, #1098).

• Auth0.swift 3.2.0 keeps the iOS/macOS SDK level in step with Android. 3.1.0 and 3.2.0 only add features (organization on resetPassword, passkey identifier verification), and this PR doesn't expose them. Taking the bump now, in the 3.0.0 major, avoids raising minimum OS versions later in a 3.x minor.

• auth0-spa-js 2.29 gives web apps the fixes from 2.24.1 through 2.29.0, including several MRRT cache fixes. The 2.25.0 release is marked breaking, but the change is TypeScript-only: getTokenSilently is now typed as possibly returning undefined (#1733). The runtime JS is unchanged, so Flutter's dart:js_interop bindings are unaffected.

Minimum iOS/macOS versions raised: Auth0.swift 3.1.0 raised its floors to iOS 15 / macOS 12 (#1277; listed as a chore, so it isn't in the 3.1.0 release notes). SPM and CocoaPods reject a dependency whose minimum is higher than the consuming package's, so the plugin has to follow:

• Package.swift and all three podspecs: iOS 14.0 → 15.0, macOS 11.0 → 12.0.
• README.md requirements table and V3_MIGRATION_GUIDE.md (Requirements Changes, with a migration note for app Podfiles and deployment targets).
• CLAUDE.md minimum versions line (also corrects Android to API 26+, already the v3 minimum).
• .github/actions/setup-darwin/action.yml: the step that pins the Flutter-generated FlutterGeneratedPluginSwiftPackage to the plugin's minimums now uses iOS 15.0 / macOS 12.0. Without this, SPM rejects the plugin in CI.

The example app already targets iOS 15 / macOS 12, so it needs no changes.

Test-only changes:

• iOS/macOS: Auth0.swift 3.1.0/3.2.0 changed the Authentication protocol requirements. SpyAuthentication (auth0_flutter/example/ios/Tests/AuthAPI/AuthAPISpies.swift) is updated to conform:

  • resetPassword(email:connection:) → resetPassword(email:connection:organization:). The plugin's existing call still compiles via the SDK's new default-argument overload, which forwards to this requirement.
  • Added login(passkey:verificationRequired:authSession:connection:audience:scope:organization:verification:).
  • Added passkeySignupChallenge(…, deliveryMethod:).
  • Moved the SignupPasskey login(passkey:challenge:…) and 11-argument passkeySignupChallenge(…organization:) stubs outside #if PASSKEYS_PLATFORM. The macOS test target doesn't define that flag; it previously relied on Auth0.swift's protocol extension methods to satisfy these requirements, and in 3.2.0 those extensions gained new parameters, so they no longer match.

  The new stubs record arguments and set the same called… flags as the existing ones, so current tests keep passing regardless of which overload the SDK routes through.

• Android: Auth0.Android 4.2.0 added defaulted parameters to signinWithPasskey (verification, verificationRequired) and signupWithPasskey (deliveryMethod). PasskeyCredentialExchangeApiRequestHandlerTest and PasskeySignupChallengeApiRequestHandlerTest now match the new arity. The plugin's calls are unchanged.

New features in these releases (passkey identifier verification, organization on resetPassword, spa-js anonymous sessions, Enterprise Connect, etc.) are not exposed in Flutter here and are not documented. Passkey identifier verification is planned as a separate feature PR after GA.

🎯 Testing

Run locally

• iOS unit tests: xcodebuild test (same invocation as CI, -skip-testing:RunnerUITests) with Xcode 26.3 on an iPhone 17 Pro simulator (iOS 26.3). 355 test cases passed, 0 failed.
• macOS unit tests: same invocation with Xcode 26.3. 300 test cases passed, 0 failed.
• Local setup mirrored CI's setup-darwin action: Swift Package Manager enabled, flutter pub get, pod install, the generated package pinned to iOS 15.0 / macOS 12.0, and a placeholder .env.
• :auth0_flutter:compileDebugKotlin builds against com.auth0.android:auth0:4.2.0 (confirmed via :auth0_flutter:dependencies).
• scripts/sync-darwin-deps.sh makes no changes, so the podspec dependency versions are in sync with Package.swift.
• Confirmed the new artifacts resolve: Maven com.auth0.android:auth0:4.2.0, CDN auth0-spa-js/2.29/auth0-spa-js.production.js, and unpkg @auth0/auth0-spa-js@2.29.0.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 3

• main
• beta-release/.*
• release/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: auth0/auth0-flutter
• Branch: develop/v3.0
• File: .coderabbit.yaml
• Commit: c48d1ec
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a5dfc8cd-fb36-4378-a38c-6cbc96f04836

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[NandanPrabhu]

@utkrishtsahu 3.2.0 has organization support to reset password in swift. lets add in flutter if not already added

[utkrishtsahu]

@NandanPrabhu will take it after making this GA