chore(deps): refresh dependencies and bump Auth0.swift to 2.25.0

[subhankarmaiti]

We had 15 open dependabot PRs, all of them behind master. Merging them one by one means 15 rebases and 15 CI runs, and each merge invalidates the next one's lockfile. Most were transitive-only churn anyway, so this rolls them into a single change that updates the manifests as well as the lockfiles.

Dependency changes:

• @auth0/auth0-spa-js 2.24.0 -> 2.24.1. Converges the MRRT cache on concurrent refresh (fix: converge MRRT cache to single RT on concurrent refresh auth0-spa-js#1702) and makes getTokenSilently respect cacheMode: 'off' (fix: remove singlePromise from getTokenSilently to respect cacheMode: 'off' auth0-spa-js#1693).
• Auth0.swift 2.24.1 -> 2.25.0 in the podspec. Only change is additive — password method enrollment on the My Account API. SimpleKeychain stays at 1.3.0 and JWTDecode at 3.3.0.
• React Native 0.86.0 -> 0.86.2, React 19.2.8, @react-native-community/cli 20.2.0, plus the routine eslint / prettier / typescript-eslint / expo / typedoc / commitlint patches.
• Example app: react-navigation, react-native-screens, babel and the webpack family moved to their latest patches.
• Transitive bumps dependabot was chasing: fast-uri, ip-address, tar, ws, postcss, linkify-it, shell-quote, brace-expansion, websocket-driver.

Two things deliberately left alone:

• Auth0.Android stays on 3.21.0. That is already the latest 3.x; the only newer artifacts are 4.0.0/4.0.1, which are a breaking major (Management API and MFA APIs removed, minSdk raised to 26). That belongs to the v6 work, not here.
• metro stays on 0.84.x. RN 0.86.2 depends on metro-runtime ^0.84.3, so the 0.87.0 bump dependabot wanted would install a duplicate metro tree.

The one source change is a prettier 3.9 reformat of a type annotation in the codegen spec — no semantic change.

No public API, config or integration pattern changed, so no doc updates.

Verification

CI only runs yarn test:ci, so the native side was checked locally.

• yarn install --immutable passes, so the lockfile is in sync
• yarn typecheck clean
• yarn lint 0 errors (the 5 remaining warnings are pre-existing on master)
• yarn test 38 suites / 721 tests / 18 snapshots, identical counts to master
• yarn build produces commonjs, module and typescript output
• pod install resolves Auth0 (2.25.0) with SimpleKeychain and JWTDecode unchanged, and corrects the stale A0Auth0 (5.10.0) entry to 5.11.0
• yarn web:build compiles on webpack 5.109.2, warnings are bundle-size only
• single resolution each for react, react-native and metro-runtime — no duplicate trees

Still to do before merge: iOS and Android device builds, and a runtime pass on the token refresh paths that spa-js 2.24.1 touches.

One gap: dependabot also has a json gem bump for example/Gemfile.lock (#1607). I could not regenerate that here because rubygems.org is unreachable from my environment, so I have left that PR open rather than closing it as superseded.

Summary by CodeRabbit

• Chores

  • Updated the Auth0 iOS SDK to version 2.25.0.
  • Refreshed React Native, React, Expo, navigation, Babel, linting, testing, TypeScript, and documentation tooling dependencies.
  • Updated the Auth0 web SDK to version 2.24.1.

• Refactor

  • Simplified internal authentication option type formatting without changing functionality.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• example/ios/Podfile.lock is excluded by !**/*.lock
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ce76cd8-bbbf-4ec1-b599-526bfb1060a8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes update CocoaPod, project, and example app package versions. They also reformat the localAuthenticationOptions type annotation without changing its type semantics.

Changes

Dependency and Type Updates

Layer / File(s)	Summary
Package version updates A0Auth0.podspec, package.json, example/package.json	Updated Auth0, React Native, React, tooling, testing, documentation, and build package versions.
Native type annotation formatting src/specs/NativeA0Auth0.ts	Reformatted the localAuthenticationOptions union type without changing its accepted types.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• auth0/react-native-auth0#1575: Updates package versions in the same project and example app manifests.

Suggested reviewers: sanchitmehtagit

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency refresh and the Auth0.swift version bump, which are the main changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependency-refresh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[semgrepcode-auth0]

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.0 at react-native-auth0/yarn.lock:13221.

Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869

🧼 Fixed in commit 6271dea 🧼