Skip to content

fix(android): bump Auth0.Android to 3.21.3 to keep users logged in after upgrade - #1706

Merged
subhankarmaiti merged 1 commit into
v5.11.4from
fix/android-bump-auth0-3.21.3
Oct 26, 2026
Merged

subhankarmaiti merged 1 commit into
v5.11.4from
fix/android-bump-auth0-3.21.3

Conversation

@subhankarmaiti

Copy link
Copy Markdown
Contributor

Bumps Auth0.Android from 3.21.2 to 3.21.3.

Apps that update from react-native-auth0 5.4.0 or older (Auth0.Android 3.12.x and earlier) straight to 5.11.2 or 5.11.3 lose their stored session on the first launch. getCredentials() rejects with CRYPTO_EXCEPTION and the saved credentials are deleted. Going through 5.9.0 to 5.11.1 first keeps the login, since those versions migrate the old PKCS1 RSA key to OAEP.

The cause was in Auth0.Android 3.21.1 and 3.21.2. When the old PKCS1 key rejected the OAEP cipher, the decrypt step deleted the RSA and AES keys before the PKCS1 migration could run, so there was nothing left to migrate. 3.21.3 (auth0/Auth0.Android#1107) stops deleting the keys there and lets the migration run first. Keys that fail the migration are still regenerated as before.

Fixes #1696

@subhankarmaiti
subhankarmaiti requested a review from a team as a code owner October 26, 2026 11:13
@coderabbitai

coderabbitai Bot commented Oct 26, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 2
  • master
  • v6-development

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@subhankarmaiti
subhankarmaiti merged commit 6cdc05f into v5.11.4 Oct 26, 2026
5 checks passed
@subhankarmaiti
subhankarmaiti deleted the fix/android-bump-auth0-3.21.3 branch October 26, 2026 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants