chore: sync main into v5_development

.github/workflows/codeql.yml

@@ -36,7 +36,7 @@ jobs:
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
       - name: Set up Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -45,15 +45,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/scorecard.yml

@@ -0,0 +1,80 @@
+name: Scorecard analysis
+
+# Runs OpenSSF Scorecard supply-chain analysis directly via ossf/scorecard-action
+# (no composite wrapper, no cross-org dependency). All action refs are SHA-pinned.
+#
+# Scorecard requirements
+# ──────────────────────
+# • Supported triggers (per OSSF) are push and schedule on the default branch.
+#   pull_request is added below ONLY as a smoke test on a real runner from the PR.
+#   workflow_dispatch provides manual smoke tests after this workflow exists on the default branch.
+#   OSSF officially documents both triggers as EXPERIMENTAL ("The pull_request and
+#   workflow_dispatch triggers are experimental" — scorecard-action README); the docs do not
+#   detail how results differ on them. Because they are experimental, treat a PR run as a
+#   smoke signal only — this workflow is fully validated only after merge to the default branch.
+# • The checkout step MUST set persist-credentials: false (required by Scorecard's
+#   security model to avoid leaking the GITHUB_TOKEN into the analysis environment).
+# • publish_results: true publishes to the public Scorecard API and enables the
+#   Scorecard badge. It requires id-token: write on the job AND a push/schedule
+#   event — it must stay false on pull_request/workflow_dispatch. Set to 'false' to
+#   keep results private (id-token can then be omitted from the job permissions).
+
+on:
+  push:
+    branches: ['main']
+  pull_request:
+    branches: ['main']   # EXPERIMENTAL per OSSF: smoke test only, not an authoritative result
+  workflow_dispatch: {}              # EXPERIMENTAL per OSSF: manual re-run, available only after merge (default-branch copy)
+  schedule:
+    - cron: '30 1 * * 6'   # weekly, Saturday 01:30 UTC
+
+permissions: read-all   # default: restrict everything; the job overrides what it needs
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # No event guard: pull_request and workflow_dispatch are allowed to run as an
+    # experimental smoke test (see the header). Keep publish_results: false on those
+    # events — publishing requires a push/schedule event and id-token: write.
+    permissions:
+      security-events: write   # upload SARIF to the Security tab / Code Scanning dashboard
+      # id-token: write           # OIDC token for Scorecard's public API publishing (publish_results: true)
+                                # Uncomment this line only when you set publish_results: true
+      contents: read            # checkout the repository
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false   # required by Scorecard — do not remove
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # publish_results: true publishes to the Scorecard public dataset and enables the badge.
+          # Requires id-token: write above and a push/schedule event.
+          # Set to 'true' (and enable id-token: write) to publish results to the Scorecard public dataset.
+          publish_results: false
+
+      # Upload SARIF as a workflow artifact (optional — comment out to disable).
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: Upload artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5 # adjust as needed
+
+      # Upload SARIF to GitHub Code Scanning dashboard (optional — comment out to disable).
+      # Skipped only for fork PRs: there the GITHUB_TOKEN is read-only (no security-events: write)
+      # and the upload fails. The guard still runs on push/schedule and on same-repo PRs, where the
+      # token can write. (github.event.pull_request is null on push/schedule, so !…fork is true.)
+      - name: Upload to code-scanning
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          sarif_file: results.sarif
+          category: scorecard

CHANGELOG.md

@@ -26,6 +26,15 @@
 
 **Added**
 - feat(embedded): add /e/authorize email OTP flow  [\#1075](https://github.com/auth0/Auth0.Android/pull/1075) ([pmathew92](https://github.com/pmathew92))
+## [4.3.1](https://github.com/auth0/Auth0.Android/tree/4.3.1) (2026-11-12)
+[Full Changelog](https://github.com/auth0/Auth0.Android/compare/4.3.0...4.3.1)
+
+**Changed**
+- docs(myaccount): mark the My Account Profile API as Beta [\#1124](https://github.com/auth0/Auth0.Android/pull/1124) ([utkrishtsahu](https://github.com/utkrishtsahu))
+
+**Fixed**
+- fix(webauth): retry code exchange while network is still blocked, make it configurable [\#1125](https://github.com/auth0/Auth0.Android/pull/1125) ([subhankarmaiti](https://github.com/subhankarmaiti))
+
 ## [4.3.0](https://github.com/auth0/Auth0.Android/tree/4.3.0) (2026-10-30)
 [Full Changelog](https://github.com/auth0/Auth0.Android/compare/4.2.1...4.3.0)
 

EXAMPLES.md

@@ -5,7 +5,7 @@ Each topic lives in its own file under [`examples/`](examples).
 ## Web Auth
 
 - [Authenticate with any Auth0 connection](examples/authenticate-with-connection.md)
-- [Web Auth configuration](examples/web-auth-configuration.md) — audience, scope, connection scope, parameters, custom authorize URL, return-to URL scheme, custom logout URL
+- [Web Auth configuration](examples/web-auth-configuration.md) — audience, scope, connection scope, parameters, custom authorize URL, token exchange retry, return-to URL scheme, custom logout URL
 - [Customize the Custom Tabs UI](examples/custom-tabs-ui.md)
 - [Trusted Web Activity](examples/trusted-web-activity.md)
 - [Ephemeral Browsing](examples/ephemeral-browsing.md)

README.md

@@ -316,10 +316,10 @@ WebAuthProvider.login(account)
     .await(this)
 ```
 
-### My Account API: user profile
+### My Account API: user profile [Beta]
 
 > [!NOTE]
-> The My Account profile API is currently in Early Access. To request access to this feature, contact your Auth0 representative.
+> The My Account profile API is currently in [Beta](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#beta). It might change before General Availability, and Auth0 does not support beta functionality for production use. The feature must be enabled for your tenant.
 
 After obtaining an access token for the My Account API, use `MyAccountAPIClient` to read the signed-in user's profile and update the fields they are allowed to edit. Each field in `profilePolicy` tells you whether it is editable and why:
 
@@ -332,7 +332,7 @@ val canEditGivenName = profile.profilePolicy["/given_name"]?.access == ProfileFi
 client.updateUserProfile(UpdateUserProfileRequest(givenName = "Jane")).await()
 ```
 
-See the [full usage example](examples/my-account-api.md#get-the-user-profile) for callback, coroutine and Java samples.
+See the [full usage example](examples/my-account-api.md#get-the-user-profile-beta) for callback, coroutine and Java samples.
 
 ## Credentials Manager
 

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

@@ -852,9 +852,10 @@ public class MyAccountAPIClient @VisibleForTesting(otherwise = VisibleForTesting
      *
      * ## Availability
      *
-     * This feature is currently available in
-     * [Early Access](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#early-access).
-     * Please reach out to Auth0 support to get it enabled for your tenant.
+     * This feature is currently in
+     * [Beta](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#beta).
+     * It might change before General Availability, and Auth0 does not support beta functionality for
+     * production use. The feature must be enabled for your tenant.
      *
      * ## Scopes Required
      * `read:me:profile`
@@ -912,9 +913,10 @@ public class MyAccountAPIClient @VisibleForTesting(otherwise = VisibleForTesting
      *
      * ## Availability
      *
-     * This feature is currently available in
-     * [Early Access](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#early-access).
-     * Please reach out to Auth0 support to get it enabled for your tenant.
+     * This feature is currently in
+     * [Beta](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#beta).
+     * It might change before General Availability, and Auth0 does not support beta functionality for
+     * production use. The feature must be enabled for your tenant.
      *
      * ## Scopes Required
      * `update:me:profile`

auth0/src/main/java/com/auth0/android/myaccount/request/GetUserProfileOptions.kt

@@ -4,6 +4,8 @@ package com.auth0.android.myaccount.request
  * Options to control which fields are returned by
  * [com.auth0.android.myaccount.MyAccountAPIClient.getUserProfile].
  *
+ * This API is currently in [Beta](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#beta) and might change before General Availability.
+ *
  * @param fields the fields to include in, or exclude from, the response, e.g.
  * `listOf("given_name", "picture", "profile_policy")`. When empty, the default set of fields is
  * returned.

auth0/src/main/java/com/auth0/android/myaccount/request/UpdateUserProfileRequest.kt

@@ -3,6 +3,8 @@ package com.auth0.android.myaccount.request
 /**
  * The changes to apply with [com.auth0.android.myaccount.MyAccountAPIClient.updateUserProfile].
  *
+ * This API is currently in [Beta](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#beta) and might change before General Availability.
+ *
  * Properties left as `null` are not sent and remain unchanged. A request with every property
  * `null` is valid and returns the current profile.
  *

auth0/src/main/java/com/auth0/android/provider/OAuthManager.kt

@@ -48,6 +48,8 @@ internal class OAuthManager(
 
     private var idTokenVerificationLeeway: Int? = null
     private var idTokenVerificationIssuer: String? = null
+    private var tokenExchangeMaxRetries: Int? = null
+    private var tokenExchangeRetryDelay: Int? = null
 
     @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
     fun setPKCE(pkce: PKCE?) {
@@ -58,6 +60,14 @@ internal class OAuthManager(
         idTokenVerificationLeeway = leeway
     }
 
+    fun setTokenExchangeMaxRetries(maxRetries: Int?) {
+        tokenExchangeMaxRetries = maxRetries
+    }
+
+    fun setTokenExchangeRetryDelay(seconds: Int?) {
+        tokenExchangeRetryDelay = seconds
+    }
+
     fun setIdTokenVerificationIssuer(issuer: String?) {
         idTokenVerificationIssuer = if (TextUtils.isEmpty(issuer)) apiClient.baseURL else issuer
     }
@@ -304,7 +314,7 @@ internal class OAuthManager(
             dPoP?.let {
                 apiClient.useDPoP(context)
             }
-            pkce = PKCE(apiClient, redirectUri, headers)
+            pkce = PKCE(apiClient, redirectUri, headers, tokenExchangeMaxRetries, tokenExchangeRetryDelay)
         }
     }
 

auth0/src/main/java/com/auth0/android/provider/OAuthManagerState.kt

@@ -36,7 +36,10 @@ internal data class OAuthManagerState(
         val idTokenVerificationLeeway: Int?,
         val idTokenVerificationIssuer: String?,
         val customAuthorizeUrl: String? = null,
-        val dPoPEnabled: Boolean
+        val dPoPEnabled: Boolean,
+        // nullable so state saved by older versions deserializes to "not set"
+        val tokenExchangeMaxRetries: Int?,
+        val tokenExchangeRetryDelay: Int?
     )
 
     fun serializeToJson(
@@ -61,7 +64,9 @@ internal data class OAuthManagerState(
                 idTokenVerificationIssuer = idTokenVerificationIssuer,
                 idTokenVerificationLeeway = idTokenVerificationLeeway,
                 customAuthorizeUrl = this.customAuthorizeUrl,
-                dPoPEnabled = this.dPoPEnabled
+                dPoPEnabled = this.dPoPEnabled,
+                tokenExchangeMaxRetries = pkce?.maxNetworkRetries,
+                tokenExchangeRetryDelay = pkce?.networkRetryDelaySeconds
             )
             return gson.toJson(json)
         } finally {
@@ -107,6 +112,8 @@ internal data class OAuthManagerState(
                         oauthManagerJson.redirectUri,
                         oauthManagerJson.codeChallenge,
                         oauthManagerJson.headers,
+                        oauthManagerJson.tokenExchangeMaxRetries,
+                        oauthManagerJson.tokenExchangeRetryDelay,
                     ),
                     idTokenVerificationIssuer = oauthManagerJson.idTokenVerificationIssuer,
                     idTokenVerificationLeeway = oauthManagerJson.idTokenVerificationLeeway,