[subhankarmaiti]

Summary

Auth0.swift, JWTDecode and SimpleKeychain now come in as Swift packages through React Native's spm_dependency, instead of the trunk pods. CocoaPods trunk goes read-only on 2026-12-02, so new Auth0.swift releases (4.0) won't reach trunk after that. A0Auth0 and React Native are still installed with CocoaPods.

 A0Auth0.podspec
-  s.dependency 'Auth0', '3.2.0'
-  s.dependency 'JWTDecode', '4.0.0'
-  s.dependency 'SimpleKeychain', '1.3.0'
+  spm_dependency(s, url: '.../Auth0.swift',      requirement: { kind: 'exactVersion', version: '3.2.0' }, products: ['Auth0'])
+  spm_dependency(s, url: '.../JWTDecode.swift',  requirement: { kind: 'exactVersion', version: '4.0.0' }, products: ['JWTDecode'])
+  spm_dependency(s, url: '.../SimpleKeychain',   requirement: { kind: 'exactVersion', version: '1.3.0' }, products: ['SimpleKeychain'])

The versions are also pinned in a version-only spm/Package.swift, which Dependabot (swift ecosystem) can bump. scripts/sync-ios-deps.sh copies them into the podspec, and an iOS dependencies workflow fails if the two drift.

Dependabot -> spm/Package.swift -> scripts/sync-ios-deps.sh -> A0Auth0.podspec
                                          ^
                    CI check fails if the podspec differs after running it

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Files ignored due to path filters: 2

• example/ios/Auth0Example.xcworkspace/xcshareddata/swiftpm/Package.resolved is excluded by !**/Package.resolved
• example/ios/Podfile.lock is excluded by !**/*.lock

Run configuration

• Source mode: Auto
• Repository: auth0/react-native-auth0
• Branch: master
• File: .coderabbit.yaml
• Commit: 00ed6b6
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Team
• Run ID: 2d172f49-2183-495f-9c98-b3b58349fb8d

Commits

Reviewing files that changed from the base of the PR and between 031b4b4 and 1126a48.

Files ignored due to path filters: 2

• example/ios/Auth0Example.xcworkspace/xcshareddata/swiftpm/Package.resolved is excluded by !**/Package.resolved
• example/ios/Podfile.lock is excluded by !**/*.lock

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Summary

Summary by CodeRabbit

• Chores

  • Added automated checks to flag mismatches between iOS package and CocoaPods version pins.
  • Added scheduled update configuration for Swift packages, excluding major-version updates.
  • Updated iOS package version pins and ignored generated Swift Package Manager files.

• Documentation

  • Added guidance for updating iOS package versions and keeping the corresponding CocoaPods versions in sync.

The pull request adds Swift Package Manager pins for three iOS dependencies and a script that synchronizes their versions with the podspec. It also adds Dependabot updates, a pull request drift check, and contributor guidance for dependency updates.

Changes: iOS Dependency Management

Layer / File(s)	Summary
Dependency pins and podspec synchronization spm/Package.swift, scripts/sync-ios-deps.sh, A0Auth0.podspec, spm/Sources/Stub/Stub.swift, CONTRIBUTING.md	The manifest pins Auth0.swift 3.2.0, JWTDecode.swift 4.0.0, and SimpleKeychain 1.3.0. The script reads those versions and updates and stages the matching podspec dependencies. The contributing guide describes the synchronization steps.
Dependency update and drift checks .github/dependabot.yml, .github/workflows/check-ios-deps.yml, .gitignore, eslint.config.mjs	Dependabot checks the Swift dependencies daily. The pull request workflow runs the synchronization script and fails when the resulting diff contains matching changes. Ignore rules exclude SwiftPM build and workspace data, and ESLint excludes spm/.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant Dependabot
  participant GitHubActions
  participant SyncScript as sync-ios-deps.sh
  participant PackageManifest as Package.swift
  participant Podspec as A0Auth0.podspec
  participant GitDiff
  Dependabot->>PackageManifest: Check for dependency updates
  GitHubActions->>SyncScript: Run on pull request
  SyncScript->>PackageManifest: Read pinned versions
  SyncScript->>Podspec: Update and stage dependency versions
  GitHubActions->>GitDiff: Check for changes from HEAD
  GitDiff-->>GitHubActions: Return whether matching changes remain

Loading

Possibly related PRs

• auth0/react-native-auth0#1695: Changes the same podspec dependency declarations, including different Auth0 version handling.
• auth0/react-native-auth0#1702: Sets the Auth0.swift 3.2.0 requirement that this pull request also pins in its Swift package manifest.

Suggested reviewers: nandanprabhu

Merge Risk: Minimal · previous review de09c

The current dependency pins synchronize correctly, and no confirmed merge-blocking issue remains.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: moving the Auth0.swift dependency to Swift Package Manager and adding Dependabot synchronization.
Description check		The description directly explains the Swift Package Manager migration, dependency pinning, synchronization script, and CI validation.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 4 files. (5 skipped: 5 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[coderabbitai]

Additional comments: 1

scripts/sync-ios-deps.sh-35-37: 1

35-37: Minor · Data Integrity & Integration · Quick win

Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Fail when a podspec version cannot be synchronized.

If a valid podspec declaration puts version: on a different line from the package URL, this line-by-line substitution makes no replacement. The script still succeeds. The workflow then sees no Git diff and reports that the versions match, even after a manifest version bump. Verify each podspec declaration and its resulting version before reporting success. (raw.githubusercontent.com)

Review info

Run configuration

• Source mode: Auto
• Repository: auth0/react-native-auth0
• Branch: master
• File: .coderabbit.yaml
• Commit: 7773710
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Team
• Run ID: 3cfabad8-578d-45fb-aa3a-529968070e25

Commits

Reviewing files that changed from the base of the PR and between 7773710 and de09cc7.

Files ignored due to path filters: 2

• example/ios/Auth0Example.xcworkspace/xcshareddata/swiftpm/Package.resolved is excluded by !**/Package.resolved
• example/ios/Podfile.lock is excluded by !**/*.lock

Files selected for processing: 9

• .github/dependabot.yml
• .github/workflows/check-ios-deps.yml
• .gitignore
• A0Auth0.podspec
• CONTRIBUTING.md
• eslint.config.mjs
• scripts/sync-ios-deps.sh
• spm/Package.swift
• spm/Sources/Stub/Stub.swift

Included review availability: This review used your included allowance. 7 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.