Repository navigation
fix(android): bump Auth0.Android to 3.21.3 to keep users logged in after upgrade - #1706
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review: 2
Please check the settings in the CodeRabbit UI or the
|
pmathew92
approved these changes
Oct 26, 2026
This was referenced Oct 26, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps Auth0.Android from 3.21.2 to 3.21.3.
Apps that update from react-native-auth0 5.4.0 or older (Auth0.Android 3.12.x and earlier) straight to 5.11.2 or 5.11.3 lose their stored session on the first launch.
getCredentials()rejects withCRYPTO_EXCEPTIONand the saved credentials are deleted. Going through 5.9.0 to 5.11.1 first keeps the login, since those versions migrate the old PKCS1 RSA key to OAEP.The cause was in Auth0.Android 3.21.1 and 3.21.2. When the old PKCS1 key rejected the OAEP cipher, the decrypt step deleted the RSA and AES keys before the PKCS1 migration could run, so there was nothing left to migrate. 3.21.3 (auth0/Auth0.Android#1107) stops deleting the keys there and lets the migration run first. Keys that fail the migration are still regenerated as before.
Fixes #1696