fix(android): bump Auth0.Android to 3.21.1-beta.0 for Keystore2 INCOMPATIBLE_DEVICE fix

[subhankarmaiti]

Changes

Bumps the bundled Auth0.Android dependency from 3.21.0 to 3.21.1-beta.0.

That release fixes credential storage failing with INCOMPATIBLE_DEVICE on newer Keystore2 hardware (Pixel 10, Galaxy S26, Android 16+). The RSA key used by SecureCredentialsManager was generated without explicitly authorizing MGF1 digests, which the newer firmware strictly enforces, so saving credentials threw on those devices. Auth0.Android now authorizes both SHA-1 and SHA-256, and treats an existing stale key's MGF1 mismatch as recoverable by deleting and regenerating it on the next login.

Nothing changes in this SDK's public API — the failure surfaced here only because we delegate credential storage to Auth0.Android.

Note that 3.21.1-beta.0 is a prerelease. It should be re-pinned to 3.21.1 once that is on Maven Central.

References

• https://github.com/auth0/Auth0.Android/releases/tag/3.21.1-beta.0
• fix(storage): authorize MGF1 digest to prevent INCOMPATIBLE_DEVICE on…3.x Auth0.Android#1048

Testing

• :react-native-auth0:compileDebugKotlin passes against the new version (no source changes needed).

• yarn build and the existing unit tests pass.

• Verified on an affected device: sign in, confirm credentials persist and getCredentials() succeeds where it previously threw INCOMPATIBLE_DEVICE.

• This change adds unit test coverage

• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• All existing and new tests complete without errors
• All active GitHub checks have passed

Summary by CodeRabbit

• Bug Fixes
  • Updated the Auth0 Android integration to a newer beta release for improved compatibility and reliability.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 545e8e67-2c01-4bca-a15f-efde3f3e006c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 965e3d1c-f2d8-4b0e-ba75-713e00bdc505

📥 Commits

Reviewing files that changed from the base of the PR and between 2d942d8 and a1dad4d.

📒 Files selected for processing (1)

• android/build.gradle

Included review availability: Your plan includes up to 4 reviews per rolling hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The Android build configuration updates the Auth0 Android implementation dependency from 3.21.0 to 3.21.1-beta.0.

Changes

Android dependency update

Layer / File(s)	Summary
Update Auth0 Android dependency android/build.gradle	The Auth0 Android implementation dependency now uses version 3.21.1-beta.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a1dad

This is a localized Android dependency update with no public API changes, supported by build, unit-test, and affected-device validation. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: amitsingh05667

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Android Auth0 dependency update and the Keystore2 compatibility fix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/android-keystore2-incompatible-device

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}