chore: sync main into v5_development by pmathew92 · Pull Request #1140 · auth0/Auth0.Android

pmathew92 · 2026-11-13T10:36:13Z

Changes

Brings the changes that landed on main since the last sync into v5_development, by merging main up to ebbf577e (Release 4.3.1). This keeps v5 from drifting further from main.

What comes over from main:

Web auth: the code exchange is retried while the network is still blocked, and the number of retries is configurable (fix(webauth): retry code exchange while network is still blocked, make it configurable #1125). This touches OAuthManager, OAuthManagerState, PKCE and WebAuthProvider, with tests.
My Account profile API: the KDoc and docs now mark it as Beta (docs(myaccount): mark the My Account Profile API as Beta #1124).
CI: the OpenSSF Scorecard workflow (chore(security): add OpenSSF Scorecard workflow #1090), the JDK setup in the rl-scanner job (chore : Added the JDK setup to the rl-scanner job #1138), and dependency bumps for codeql and setup-java.
CHANGELOG.md: the 4.3.0 and 4.3.1 entries.

Checklist

I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors

🤖 Generated with Claude Code

RSADecrypt deleted the RSA/AES keys on InvalidKeyException (and the AES key + legacy IV on ProviderException) before tryRecoverCurrentAESKey could run the PKCS1 migration, logging out users upgrading from SDK <= 3.12.x / 2.x. RSADecrypt now only throws CryptoException; recovery and cleanup stay in tryRecoverCurrentAESKey, so the MGF1 regeneration from #1048 is unchanged. Fixes auth0/react-native-auth0#1696 Co-Authored-By: Claude (cherry picked from commit 15b91f1)

…1110)

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Add getUserProfile and updateUserProfile to MyAccountAPIClient for GET/PATCH /me/v1/profile, with MyAccountProfile, ProfileFieldPolicy, GetUserProfileOptions and UpdateUserProfileRequest. Includes unit tests and My Account API examples. Co-Authored-By: Claude

Move GetUserProfileOptions and UpdateUserProfileRequest to a request package, use non-null defaults for GetUserProfileOptions, correct the profilePolicy rule in the docs and stop logging profiles in the examples. Co-Authored-By: Claude <noreply@anthropic.com>

…le-api

Default profilePolicy to an empty map and mark the profile APIs as Early Access in the KDoc and examples. Co-Authored-By: Claude <noreply@anthropic.com>

Co-Authored-By: Claude <noreply@anthropic.com>

)

Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

…39.1 in the codeql group (#1119) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

Co-Authored-By: Claude <noreply@anthropic.com>

…e it configurable

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…-java group (#1129) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

…x/retry-code-exchange-network-error

…e it configurable (#1125)

Merges main up to ebbf577 (Release 4.3.1) into v5_development. - Conflicts in the My Account profile files and codeql.yml came from the squash-merged previous sync (#1117); main's versions were newer and taken. - README keeps v5's version string; main's My Account profile Beta update was applied by hand because README uses merge=ours. Co-Authored-By: Claude <noreply@anthropic.com>

coderabbitai · 2026-11-13T10:36:22Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Team
Run ID: 22747875-fb5e-4ef7-823f-14de2cf5ca3a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

utkrishtsahu and others added 30 commits October 26, 2026 10:52

fix(storage): keep RSA key for PKCS1 migration on padding mismatch (#…

f963502

…1110)

Release 4.2.1

8964fe3

docs(changelog): add 3.21.3 release history

720c941

Release 4.2.1 (#1112)

74f2365

chore(deps): bump the codeql group with 3 updates (#1114)

c3ba7b9

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into feat/my-account-profi…

e84fc42

…le-api

refactor(myaccount): address review feedback on defaults and EA docs

ccf025b

Default profilePolicy to an empty map and mark the profile APIs as Early Access in the KDoc and examples. Co-Authored-By: Claude <noreply@anthropic.com>

docs(readme): add My Account profile section

93df6a1

Co-Authored-By: Claude <noreply@anthropic.com>

feat(myaccount): Add getUserProfile and updateUserProfile methods (#1115

6f15116

)

Release 4.3.0

96c2ba2

Release 4.3.0 (#1116)

d9fb677

chore(security): add OpenSSF Scorecard workflow (#1090)

c1e6ddc

Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.…

0699d46

…39.1 in the codeql group (#1119) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1120)

4dfff89

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.5.0 (#1121)

9234203

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1122)

d031ee6

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

docs(myaccount): mark the My Account Profile API as Beta

c02f7c7

Co-Authored-By: Claude <noreply@anthropic.com>

docs(myaccount): mark the My Account Profile API as Beta (#1124)

8af0205

fix(webauth): retry code exchange while network is still blocked, mak…

b236beb

…e it configurable

chore(deps): bump the codeql group with 4 updates (#1126)

807c533

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump actions/setup-java from 6.1.0 to 6.2.0 in the setup…

58dc51b

…-java group (#1129) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): bump the codeql group with 4 updates (#1128)

feef30b

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prince Mathew <17837162+pmathew92@users.noreply.github.com>

address review comments and add max retry

f0e4fa8

Merge branch 'main' of https://github.com/auth0/Auth0.Android into fi…

20bbc41

…x/retry-code-exchange-network-error

fix(webauth): cap token exchange retries at 4

c0031d5

fix(webauth): retry code exchange while network is still blocked, mak…

32f424c

…e it configurable (#1125)

Release 4.3.1

1a44d0f

subhankarmaiti and others added 5 commits November 12, 2026 16:10

chore : Added the JDK setup to the rl-scanner job

c5db6cd

chore : Added the JDK setup to the rl-scanner job (#1138)

e47a266

Merge branch 'main' into release/4.3.1

f7fe911

Release 4.3.1 (#1137)

ebbf577

pmathew92 changed the title ~~chore: sync main into v5_development [non-main]~~ chore: sync main into v5_development Nov 13, 2026

pmathew92 marked this pull request as ready for review November 13, 2026 10:38

pmathew92 requested a review from a team as a code owner November 13, 2026 10:38

subhankarmaiti approved these changes Nov 13, 2026

View reviewed changes

pmathew92 merged commit a305835 into v5_development Nov 13, 2026
7 checks passed

pmathew92 deleted the sync/main-into-v5-2026-11-13 branch November 13, 2026 10:44

Navigation Menu

Repository navigation

chore: sync main into v5_development - #1140

chore: sync main into v5_development #1140
pmathew92 merged 35 commits into
v5_developmentfrom
sync/main-into-v5-2026-11-13

pmathew92 commented Nov 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 13, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

pmathew92 commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Checklist

Uh oh!

coderabbitai Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pmathew92 commented Nov 13, 2026 •

edited

Loading

coderabbitai Bot commented Nov 13, 2026 •

edited

Loading