feat(ios): pull Auth0.swift via SPM and add dependabot sync

.github/dependabot.yml

@@ -21,3 +21,14 @@ updates:
     ignore:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
+  - package-ecosystem: swift
+    directory: /spm
+    schedule:
+      interval: daily
+    allow:
+      - dependency-name: 'github.com/auth0/auth0.swift'
+      - dependency-name: 'github.com/auth0/jwtdecode.swift'
+      - dependency-name: 'github.com/auth0/simplekeychain'
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major']

.github/workflows/check-ios-deps.yml

@@ -0,0 +1,36 @@
+## Can be removed once A0Auth0.podspec no longer duplicates the Auth0.swift version pins
+
+name: iOS dependencies
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+jobs:
+  check-ios-deps:
+    name: Check podspec dependency versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Run check
+        run: |
+          scripts/sync-ios-deps.sh
+
+          if git diff HEAD --quiet --diff-filter=ACDMRT; then
+              echo $'\nPodspec dependency versions are in sync with spm/Package.swift.'
+          else
+              echo $'\nThe podspec dependency versions are out of sync with spm/Package.swift.'
+              echo "Run 'scripts/sync-ios-deps.sh' from the repository root and commit the changes."
+              exit 1
+          fi

.gitignore

@@ -97,4 +97,9 @@ android/generated
 dist/
 out/
 coverage/
-docs/
+docs/
+
+# SwiftPM output (spm/ is a version-only manifest; pins are exact)
+spm/.build/
+spm/Package.resolved
+example/ios/*.xcworkspace/xcshareddata/swiftpm/

A0Auth0.podspec

@@ -17,9 +17,10 @@ Pod::Spec.new do |s|
   s.resource_bundles = { 'A0Auth0_privacy' => 'ios/PrivacyInfo.xcprivacy' }
   s.requires_arc = true
 
-  s.dependency 'Auth0', '3.2.0'
-  s.dependency 'JWTDecode', '4.0.0'
-  s.dependency 'SimpleKeychain', '1.3.0'
+  # Pulled via SPM since CocoaPods trunk is going read-only (2026-12-02)
+  spm_dependency(s, url: 'https://github.com/auth0/Auth0.swift', requirement: { kind: 'exactVersion', version: '3.2.0' }, products: ['Auth0'])
+  spm_dependency(s, url: 'https://github.com/auth0/JWTDecode.swift', requirement: { kind: 'exactVersion', version: '4.0.0' }, products: ['JWTDecode'])
+  spm_dependency(s, url: 'https://github.com/auth0/SimpleKeychain', requirement: { kind: 'exactVersion', version: '1.3.0' }, products: ['SimpleKeychain'])
 
   install_modules_dependencies(s)
 end

CONTRIBUTING.md

@@ -86,6 +86,10 @@ The `package.json` file contains various scripts for common tasks:
 - `yarn example android`: run the example app on Android.
 - `yarn example ios`: run the example app on iOS.
 
+### iOS dependency versions
+
+The Auth0.swift, JWTDecode.swift and SimpleKeychain versions are pinned in `spm/Package.swift`, which Dependabot updates. `A0Auth0.podspec` repeats them, so after a bump run `scripts/sync-ios-deps.sh` from the repo root and commit the result. The `iOS dependencies` workflow fails when they drift.
+
 ### Sending a pull request
 
 When you're sending a pull request:

eslint.config.mjs

@@ -49,6 +49,6 @@ export default defineConfig([
     },
   },
   {
-    ignores: ['node_modules/', 'lib/', 'docs', 'example/', 'coverage/'],
+    ignores: ['node_modules/', 'lib/', 'docs', 'example/', 'coverage/', 'spm/'],
   },
 ]);

example/ios/Podfile.lock

@@ -1,8 +1,6 @@
 PODS:
-  - A0Auth0 (6.0.0):
-    - Auth0 (= 3.2.0)
+  - A0Auth0 (6.1.0):
     - hermes-engine
-    - JWTDecode (= 4.0.0)
     - RCTRequired
     - RCTTypeSafety
     - React-bridging
@@ -23,11 +21,7 @@ PODS:
     - ReactCodegen
     - ReactCommon/turbomodule/core
     - ReactNativeDependencies
-    - SimpleKeychain (= 1.3.0)
     - Yoga
-  - Auth0 (3.2.0):
-    - JWTDecode (= 4.0)
-    - SimpleKeychain (= 1.3.0)
   - boost (1.84.0):
     - ReactNativeDependencies
   - DoubleConversion (1.1.6):
@@ -43,7 +37,6 @@ PODS:
   - hermes-engine (260318099.0.4):
     - hermes-engine/Pre-built (= 260318099.0.4)
   - hermes-engine/Pre-built (260318099.0.4)
-  - JWTDecode (4.0.0)
   - RCT-Folly (2024.11.18.00):
     - RCT-Folly/Default (= 2024.11.18.00)
     - ReactNativeDependencies
@@ -1843,7 +1836,6 @@ PODS:
     - React-utils (= 0.88.0)
     - ReactNativeDependencies
   - ReactNativeDependencies (0.88.0)
-  - SimpleKeychain (1.3.0)
   - SocketRocket (0.7.1):
     - ReactNativeDependencies
   - Yoga (0.0.0):
@@ -1940,12 +1932,6 @@ DEPENDENCIES:
   - SocketRocket (from `build/rndeps-facades/SocketRocket`)
   - Yoga (from `build/rncore-facades/Yoga`)
 
-SPEC REPOS:
-  trunk:
-    - Auth0
-    - JWTDecode
-    - SimpleKeychain
-
 EXTERNAL SOURCES:
   A0Auth0:
     :path: "../.."
@@ -2126,16 +2112,14 @@ EXTERNAL SOURCES:
     :path: build/rncore-facades/Yoga
 
 SPEC CHECKSUMS:
-  A0Auth0: 0c4eb7421f5c25d8ff14f0c0950312f24d025a6d
-  Auth0: a46f78a751b6b77b533c22d4ede90d985cb6112c
+  A0Auth0: 1b5e9fe32351372335be026512ca6f7a5fc09fca
   boost: 8502bfdc46e2804408af2e163049ece181009af4
   DoubleConversion: 501a575c40c0b50c89685762dd3e415e6bb26fb0
   fast_float: 7c925d1cebf8328d4018d061f49377e9f887e3b4
   FBLazyVector: fdebac2dfe9c53bca49f8218fbdf1e24e36c8be0
   fmt: ba0886e864ebb21d14c98b2e12e164b8002f5b93
   glog: 3cf7cb46f743c4bc758ae3e6d9c15bd1b4cfd6d4
   hermes-engine: a1158910bb7e300b9e3d2f1e2d433f817ec1a4b5
-  JWTDecode: a420459e8c73d7840cb6a6a7a1eb89c894d58499
   RCT-Folly: 82921e585c0400eda46fac1068297aa9dfb035e4
   RCTDeprecation: e134f2a2c096a6450f5fcbbe949531f913a2ff04
   RCTRequired: f1a68295837ee8f91e112ed1b5694d12e7ff1784
@@ -2214,7 +2198,6 @@ SPEC CHECKSUMS:
   ReactCodegen: 7b71f4464442e9b6eae41094d11076d56c51c0e3
   ReactCommon: 145a14b942b19fc2fe38927f261955ada56978aa
   ReactNativeDependencies: d3b7423ba1e52525e42085c8470109abde583d2e
-  SimpleKeychain: 9c0f3ca8458fed74e01db864d181c5cbe278603e
   SocketRocket: 37aec555668fb852ec12e3c0de59a86ca58f0871
   Yoga: d1c536142c5ff8ec8cd856ab2a7c227a1d875c8e
 

scripts/sync-ios-deps.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Copies the Auth0 native dependency versions pinned in spm/Package.swift into
+# A0Auth0.podspec. Package.swift is the source of truth: Dependabot (swift
+# ecosystem) bumps it, and this script propagates the new version to the podspec.
+#
+# Run from the repository root.
+
+set -euo pipefail
+
+repo_path=$(git rev-parse --show-toplevel)
+
+if [ "$repo_path" != "$PWD" ]; then
+    echo 'This script must be run from the repository root'
+    exit 1
+fi
+
+package_swift='spm/Package.swift'
+podspec='A0Auth0.podspec'
+
+# Swift package URL suffix as it appears in Package.swift and in the podspec's
+# spm_dependency calls (`url: 'https://github.com/auth0/<name>'`).
+packages=('Auth0.swift' 'JWTDecode.swift' 'SimpleKeychain')
+
+for name in "${packages[@]}"; do
+    # Match the quoted URL so Auth0.swift cannot match a longer URL.
+    line=$(grep -F "github.com/auth0/${name}\"" "$package_swift" || true)
+    version=$(printf '%s\n' "$line" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
+
+    if [ -z "$version" ]; then
+        echo "::error::Could not find a version for '$name' in $package_swift"
+        exit 1
+    fi
+
+    NAME="$name" VER="$version" perl -i -pe \
+        's/(github\.com\/auth0\/\Q$ENV{NAME}\E\x27.*?version:\s*\x27)\d+\.\d+\.\d+(\x27)/$1$ENV{VER}$2/' \
+        "$podspec"
+done
+
+git add "$podspec"
+
+echo 'Podspec dependency versions synced with spm/Package.swift.'

spm/Package.swift

@@ -0,0 +1,24 @@
+// swift-tools-version: 6.0
+// Version source for the Auth0 iOS dependencies. Dependabot bumps the pins here and
+// scripts/sync-ios-deps.sh copies them into A0Auth0.podspec. Not shipped or built.
+import PackageDescription
+
+let package = Package(
+    name: "A0Auth0Versions",
+    platforms: [.iOS(.v15)],
+    dependencies: [
+        .package(url: "https://github.com/auth0/Auth0.swift", exact: "3.2.0"),
+        .package(url: "https://github.com/auth0/JWTDecode.swift", exact: "4.0.0"),
+        .package(url: "https://github.com/auth0/SimpleKeychain", exact: "1.3.0"),
+    ],
+    targets: [
+        .target(
+            name: "Stub",
+            dependencies: [
+                .product(name: "Auth0", package: "Auth0.swift"),
+                .product(name: "JWTDecode", package: "JWTDecode.swift"),
+                .product(name: "SimpleKeychain", package: "SimpleKeychain"),
+            ]
+        ),
+    ]
+)

spm/Sources/Stub/Stub.swift

@@ -0,0 +1 @@
+// Placeholder so the package resolves.