Version 10.0.0-beta05 by russellwheatley · Pull Request #2459 · firebase/FirebaseUI-Android

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

russellwheatley · 2026-08-28T13:30:50Z

⚠️ Breaking Changes

feat(auth): reshape reauthContent into a ReauthContentState content slot- feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
feat(auth)!: make each email sign-in mode a real navigation destination - feat(auth)!: make each email sign-in mode a real navigation destination #2466
feat(auth)!: migrate auth navigation to Navigation 3 - feat(auth)!: migrate auth navigation to Navigation 3 #2469
build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37- build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37 #2464

Changes

fix(auth)!: remove non-functional MFA recovery codes - fix(auth)!: remove non-functional MFA recovery codes #2457
refactor(auth): scope phone verification loading state to the composition that owns it - refactor(auth): scope phone verification loading state to the composition that owns it #2454
fix(e2e): fix flaky Google credential-linking test- fix(e2e): fix flaky Google credential-linking test #2455
fix(auth): complete MFA challenge sign-in navigation and success callback- fix(auth): complete MFA challenge sign-in navigation and success callback #2458
feat(auth): add stable resource ids for auth input fields- feat(auth): add stable resource ids for auth input fields #2449
test(auth): pin onComplete and factor refresh on successful MFA enrollment - test(auth): pin onComplete and factor refresh on successful MFA enrollment #2462
feat(auth): make each MFA enrollment step a real navigation destination - feat(auth): make each MFA enrollment step a real navigation destination #2467
feat(auth): make reauthentication a navigation destination - feat(auth): make reauthentication a navigation destination #2471
fix(auth): clear MFA enrollment flow state on every entry- fix(auth): clear MFA enrollment flow state on every entry #2473
feat(auth): make each phone auth step a real navigation destination- feat(auth): make each phone auth step a real navigation destination #2472
fix(auth): don't strand phone-only users on email verification after reload- fix(auth): don't strand phone-only users on email verification after reload #2474

gemini-code-assist

Code Review

This pull request removes the recovery codes feature from the Multi-Factor Authentication (MFA) enrollment flow, including the ShowRecoveryCodes step, configuration options, state properties, UI components, localized string resources, and associated tests. I have no feedback to provide.

…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

…back (#2458)

…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

…lot (#2452) * feat(auth): reshape reauthContent into a ReauthContentState content slot * fix(auth): address reauth review findings and retain state across recreation * refactor(auth): make reauthentication a request-scoped state machine * fix(auth): keep a proved reauthentication alive when its operation signs out * fix(auth): tear down phone verification when a reauthentication attempt fails * test(auth): cover sign-out-during-retry and phone reauth failure end to end * test(auth): drop the flaky phone reauth e2e case

…lment (#2462) * test(auth): pin onComplete and factor refresh on successful MFA enrollment * test(auth): pin the SMS MFA enrollment route through send, verify and resend * test(auth): pin the missing TOTP secret guard and the resend's clean enroll

…on (#2466)

…on (#2467)

…2472)

…reload (#2474)

github-project-automationBot added this to studio-2394994192-60a69 Aug 28, 2026

github-project-automationBot moved this to Backlog in studio-2394994192-60a69 Aug 28, 2026

gemini-code-assistBot reviewed Aug 28, 2026
View reviewed changes

demolaf changed the title ~~fix(auth)!: remove non-functional MFA recovery codes (#2457)~~Version 10.0.0 beta05Aug 28, 2026

demolaf mentioned this pull request Sep 1, 2026
feat(auth): reshape reauthContent into a ReauthContentState content slot #2452
Merged

demolafand others added 9 commits September 1, 2026 17:17

fix(auth)!: remove non-functional MFA recovery codes (#2457)
e859949

refactor(auth): scope phone verification loading state to the composi…
f8ea8ea
…tion that owns it (#2454) * refactor(auth): let the phone screen own its verification loading state * fix(auth): read auth state per authUI instance when clearing loading on dispose

fix(e2e): fix flaky Google credential-linking test (#2455)
2dd87cf

fix(auth): complete MFA challenge sign-in navigation and success call…
4eb910f
…back (#2458)

feat(auth): add stable resource ids for auth input fields (#2449)
4b68e42

fix(auth): log diagnostic warning when Google sign-in NoCredentialExc…
57018e5
…eption fallback exhausts (cherry picked from commit 6fa4f00) (cherry picked from commit aca99e7) (cherry picked from commit 8784b13ce29739ed7785aab9ab6fe4faad2a2981)

fix(e2e): retry and fail loudly when clearing Firebase Auth emulator …
bd39e3b
…data (cherry picked from commit 8eca4fa) (cherry picked from commit ac61312) (cherry picked from commit 126ba985660ff272dbfda427b644ad4fb1ca6197)

fix(e2e): don't swallow InterruptedException in emulator clear retry …
a39e7d6
…loop (cherry picked from commit a87cfe3) (cherry picked from commit 3f4ae70) (cherry picked from commit 1f1ada380039ed5e7476dfc2e38a683e6edb4549)

demolaf force-pushed the version-10.0.0-beta05 branch from 444543d to 059bba8Compare September 1, 2026 16:17

demolaf marked this pull request as ready for review September 1, 2026 16:22

demolaf added 7 commits September 2, 2026 13:08

feat(auth)!: make each email sign-in mode a real navigation destinati…
217e039
…on (#2466)

feat(auth): make each MFA enrollment step a real navigation destinati…
bfc90ec
…on (#2467)

feat(auth)!: migrate auth navigation to Navigation 3 (#2469)
156d7f5

feat(auth): make reauthentication a navigation destination (#2471)
a340cb3

fix(auth): clear MFA enrollment flow state on every entry (#2473)
9f7aad8

feat(auth): make each phone auth step a real navigation destination (#…
b20855b
…2472)

russellwheatley changed the title ~~Version 10.0.0 beta05~~Version 10.0.0-beta05Sep 2, 2026

fix(auth): don't strand phone-only users on email verification after …
df1ef1b
…reload (#2474)