chore: sync V3 with master by sanchitmehtagit · Pull Request #1126 · auth0/Auth0.swift

sanchitmehtagit · 2026-03-23T13:21:44Z

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

📋 Changes

Merge Master to V3
resolved conflicts

… DX (#1110)

#1109) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: sanchitmehtagit <sanchitnitj@gmail.com> Co-authored-by: nandan_prabhu <nandan.prabhup@okta.com>

#1121) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Copilot

Pull request overview

Syncs the V3 branch with master by merging in upstream changes, updating published docs/artifacts, and aligning tests and CI configuration with the latest SDK behavior.

Changes:

Bumps SDK/versioned artifacts to 2.18.0 (README install snippets, podspec, Info.plist, Version.swift, changelog).
Updates Web Auth flow to always generate/pass a nonce and updates related tests.
Regenerates DocC JSON files and updates docs (DPoP GA wording, adds isRetryable docs, adds Management API (Users) examples), plus minor CI action pin bumps.

Reviewed changes

Copilot reviewed 66 out of 816 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
docs/data/documentation/auth0/authentication/logindefaultdirectory(withusername:password:audience:scope:)-4gru8.json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/login(withotp:mfatoken:).json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/login(phonenumber:code:audience:scope:)-8kbii.json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/login(facebooksessionaccesstoken:profile:audience:scope:)-28ncj.json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/login(email:code:audience:scope:)-39g8b.json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/jwks().json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/codeexchange(withcode:codeverifier:redirecturi:).json	Regenerated DocC JSON for method documentation.
docs/data/documentation/auth0/authentication/clientid.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/authentication(session:bundle:).json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/authentication(clientid:domain:session:).json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0error/localizeddescription.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0error/errordescription.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0error/cause.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0error/cause-9wuyi.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0error/cause-97kwn.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0apierror/statuscode.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0apierror/isretryable.json	Adds DocC JSON for new public `isRetryable` API documentation.
docs/data/documentation/auth0/auth0apierror/isnetworkerror.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0apierror/init(info:statuscode:).json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0apierror/info.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/auth0apierror/code.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/tokentype.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/scope.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/init(from:)-8e5ds.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/init(from:)-5sa91.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/init(accesstoken:tokentype:expiresin:scope:).json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/expiresin.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/description.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials/decodable-implementations.json	Regenerated DocC JSON for default implementations page.
docs/data/documentation/auth0/apicredentials/accesstoken.json	Regenerated DocC JSON for symbol documentation.
docs/data/documentation/auth0/apicredentials.json	Regenerated DocC JSON for type page.
README.md	Updates install snippet versions to 2.18.
EXAMPLES.md	Updates DPoP section wording/anchors, documents `isRetryable`, and adds Management API (Users) examples.
CHANGELOG.md	Adds 2.18.0 changelog entry.
Auth0Tests/WebAuthSpec.swift	Updates URL building tests to pass nonce; adds state/nonce tests.
Auth0Tests/AuthenticationErrorSpec.swift	Adds test coverage for `isRetryable`.
Auth0/Version.swift	Bumps runtime version constant to 2.18.0.
Auth0/Info.plist	Bumps CFBundleShortVersionString to 2.18.0.
Auth0/DPoP/SenderConstraining.swift	Removes Early Access availability notes from DPoP docs.
Auth0/DPoP/DPoP.swift	Removes Early Access availability notes from DPoP docs.
Auth0/Auth0WebAuth.swift	Introduces always-generated nonce + refactors state generation helper.
Auth0/Auth0APIError.swift	Makes `isRetryable` public via `public extension`.
Auth0.podspec	Bumps podspec version to 2.18.0.
.github/workflows/main.yml	Updates Codecov GitHub Action pin.
.github/actions/setup/action.yml	Updates ruby/setup-ruby GitHub Action pin.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T13:39:19Z

EXAMPLES.md

 - [Web Auth configuration](#web-auth-configuration)
 - [ID token validation](#id-token-validation)
- [DPoP [EA]](#dpop-ea)
+- [DPoP](#dpop)


The TOC entry was changed to link to #dpop, but the section header still includes [EA] (### DPoP [EA]), which will typically generate an anchor like #dpop-ea on GitHub and break the link. Rename the heading to ### DPoP (and similarly anywhere else [EA] remains) so the anchors match the updated TOC.

Copilot · 2026-03-23T13:39:20Z

EXAMPLES.md

@@ -490,10 +490,7 @@ Auth0

 ### DPoP [EA]


The TOC entry was changed to link to #dpop, but the section header still includes [EA] (### DPoP [EA]), which will typically generate an anchor like #dpop-ea on GitHub and break the link. Rename the heading to ### DPoP (and similarly anywhere else [EA] remains) so the anchors match the updated TOC.

Suggested change

### DPoP [EA]

### DPoP

Copilot · 2026-03-23T13:39:20Z

Auth0Tests/WebAuthSpec.swift

+                        .buildAuthorizeURL(withRedirectURL: RedirectURL, defaults: defaults, nonce: Nonce, state: State),
                    "domain": Domain,
                    "query": defaultQuery(),


These URL-building tests now pass a nonce, and buildAuthorizeURL appears to always include nonce in the query. However, the expected query is still defaultQuery() (which, per the provided helper, does not include nonce). This will likely cause the shared behavior assertions to fail. Update the expected query to include the nonce (e.g., extend defaultQuery to accept a nonce parameter or include it in withParameters: for these cases).

Copilot · 2026-03-23T13:39:21Z

Auth0/Auth0WebAuth.swift

+    func generateRandomString() -> String {
        let data = Data(count: 32)
        var tempData = data
-
        let result = tempData.withUnsafeMutableBytes {
            SecRandomCopyBytes(kSecRandomDefault, data.count, $0.baseAddress!)
        }
-
-        guard result == 0, let state = tempData.a0_encodeBase64URLSafe()
+        guard result == errSecSuccess, let randomString = tempData.a0_encodeBase64URLSafe()
        else { return UUID().uuidString.replacingOccurrences(of: "-", with: "") }
-
-        return state
+        return randomString
    }


In generateRandomString, SecRandomCopyBytes is called with data.count even though the buffer being filled is tempData. Using tempData.count avoids accidental divergence if this method changes. Also consider creating tempData directly (instead of allocating data then copying) to reduce unnecessary copying (optional).

NandanPrabhu · 2026-03-24T04:01:07Z

source branch can be chore/master2developv3.0

sanchitmehtagit and others added 8 commits March 5, 2026 12:30

feat: make Auth0APIError.isRetryable public for better Error Handling…

ad5c8e6

… DX (#1110)

Release 2.18.0 (#1111)

ece1e9b

doc: Removed EA tag for DPoP (#1112)

6022973

Bump ruby/setup-ruby from 1.289.0 to 1.295.0 in /.github/actions/setup (

2b2f0db

#1121) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Nonce computation changes (#1118)

0b756f7

Bump codecov/codecov-action from 5.5.2 to 5.5.3 (#1122)

d4fb7cb

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge remote-tracking branch 'origin' into chore/developToV3.0

1340f77

sanchitmehtagit requested a review from a team as a code owner March 23, 2026 13:21

sanchitmehtagit changed the base branch from master to develop/v3.0 March 23, 2026 13:22

sanchitmehtagit changed the title ~~chore: Develop To Swift V3~~ chore: sync V3 with master Mar 23, 2026

pmathew92 requested a review from Copilot March 23, 2026 13:36

Copilot AI reviewed Mar 23, 2026

View reviewed changes

pmathew92 previously approved these changes Mar 23, 2026

View reviewed changes

fix test

2306fb4

sanchitmehtagit dismissed pmathew92’s stale review via 2306fb4 March 24, 2026 04:17

NandanPrabhu approved these changes Mar 24, 2026

View reviewed changes

Merge branch 'develop/v3.0' into chore/developToV3.0

c8e036b

sanchitmehtagit enabled auto-merge March 24, 2026 06:01

sanchitmehtagit merged commit 8be23a3 into develop/v3.0 Mar 24, 2026
9 checks passed

sanchitmehtagit deleted the chore/developToV3.0 branch March 24, 2026 06:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync V3 with master#1126

chore: sync V3 with master#1126
sanchitmehtagit merged 10 commits intodevelop/v3.0from
chore/developToV3.0

sanchitmehtagit commented Mar 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

NandanPrabhu commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

sanchitmehtagit commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📋 Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

NandanPrabhu commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sanchitmehtagit commented Mar 23, 2026 •

edited

Loading