chore: align example to React Native 0.87.0, bump deps, and web/native parity fixes

EXAMPLES-WEB.md

@@ -340,6 +340,25 @@ The web platform supports direct authentication grants including `auth.passwordR
 
 Token refresh is handled automatically by `credentialsManager.getCredentials()` on the web. The `auth.refreshToken()` method is not available.
 
+### Organizations and invitations (Web)
+
+Organization login works the same as on native — pass `organization` to `authorize()`:
+
+```js
+await authorize({ organization: 'org_id' });
+```
+
+Accepting an invitation is also supported. Pass the full invitation URL as `invitationUrl`; the SDK extracts the `invitation` and `organization` query parameters and forwards them to Auth0:
+
+```js
+await authorize({
+  invitationUrl:
+    'https://myapp.com/login?invitation=inv123&organization=org123',
+});
+```
+
+On the web the invitation link opens your app in the browser, so read the current URL (e.g. `window.location.href`) and pass it as `invitationUrl`.
+
 ### My Account API (Web)
 
 The [My Account API](./EXAMPLES.md#my-account-api) is supported on the web platform. The `auth0.myAccount` client works the same way as on native, so the examples in [EXAMPLES.md](./EXAMPLES.md#my-account-api) apply. Passkey enrollment on the web uses the browser's [WebAuthn](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) APIs instead of a native passkey module.

EXAMPLES.md

@@ -931,6 +931,8 @@ auth0.webAuth
 
 If the URL doesn't contain the expected values, an error will be raised through the provided callback.
 
+On the web, pass the same `invitationUrl` to `authorize()`; see [Organizations and invitations (Web)](./EXAMPLES-WEB.md#organizations-and-invitations-web).
+
 ## Multi-Resource Refresh Tokens (MRRT)
 
 ### MRRT Overview

MIGRATION_GUIDE.md

@@ -49,7 +49,7 @@ Before updating the library, ensure your project meets the new minimum requireme
 
 #### For Expo Projects
 
-Expo SDK 55+ uses the New Architecture only.
+Expo SDK 55+ uses the New Architecture only. Use **Expo SDK 55 or higher**.
 
 ```bash
 npx expo prebuild --clean

README.md

@@ -32,9 +32,9 @@ We're excited to announce the release of react-native-auth0 `v5.0.0`!
 
 ### Requirements
 
-This SDK targets apps that are using React Native SDK version `0.82.0` and up. If you're using an older React Native version, see the compatibility matrix below.
+This SDK targets apps that are using React Native SDK version `0.82.0` and up. If you're using an older React Native version, stay on an earlier release of this SDK (see below).
 
-React Native `0.82` is the first React Native release that runs **entirely on the New Architecture**. As of v6, this SDK is **New Architecture-only** — the Legacy Architecture is no longer supported. If your app has not yet moved to the New Architecture, upgrade to React Native `0.82`+ or stay on v5.x. For Expo, this SDK requires **Expo SDK 55 or higher** (Expo 54 ships React Native `0.81`, below the `0.82` floor).
+This SDK is **New Architecture-only** — the Legacy Architecture is no longer supported. React Native `0.82` is the first release to run entirely on the New Architecture; as of v6, this SDK requires React Native `0.82`+. If your app has not yet moved to the New Architecture, upgrade to `0.82`+ or stay on v5.x.
 
 > ⚠️ **Warning**: For Expo, this version requires **Expo SDK 55 or higher** (Expo 54 ships React Native `0.81`, below the `0.82` floor). If you are on an earlier Expo version, upgrade Expo or stay on react-native-auth0 `5.x` (Expo 53–54) or `4.x` (below Expo 53).
 
@@ -526,13 +526,14 @@ const Component = () => {
 
 <details>
   <summary>Using the `Auth0` class</summary>
-
-  ```js
-  auth0.webAuth
-    .authorize()
-    .then(credentials => console.log(credentials))
-    .catch(error => console.log(error));
-  ```
+
+```js
+auth0.webAuth
+  .authorize()
+  .then(() => console.log('Authentication succeeded'))
+  .catch((error) => console.log(error));
+```
+
 </details>
 
 > Web Authentication flows require a Browser application installed on the device. When no Browser is available, an error of type `a0.browser_not_available` will be raised via the provided callback.
@@ -681,16 +682,16 @@ The options for configuring the display of local authentication prompt, authenti
 
 **Properties:**
 
-| Property                   | Type                                     | Description                                                                                                                                 | Applicable Platforms |
-| -------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
-| `title`                    | `String`                                 | The title of the authentication prompt.                                                                                                     | Android, iOS         |
-| `subtitle`                 | `String` (optional)                      | The subtitle of the authentication prompt.                                                                                                  | Android              |
-| `description`              | `String` (optional)                      | The description of the authentication prompt.                                                                                               | Android              |
-| `cancelTitle`              | `String` (optional)                      | The cancel button title of the authentication prompt.                                                                                       | Android, iOS         |
-| `evaluationPolicy`         | `LocalAuthenticationStrategy` (optional) | The evaluation policy to use when prompting the user for authentication. Defaults to `deviceOwnerWithBiometrics`.                           | iOS                  |
-| `fallbackTitle`            | `String` (optional)                      | The fallback button title of the authentication prompt.                                                                                     | iOS                  |
-| `authenticationLevel`      | `LocalAuthenticationLevel` (optional)    | The authentication level to use when prompting the user for authentication. Defaults to `strong`.                                           | Android              |
-| `deviceCredentialFallback` | `Boolean` (optional)                     | Should the user be given the option to authenticate with their device PIN, pattern, or password instead of a biometric. Defaults to `false` | Android              |
+| Property                   | Type                                     | Description                                                                                                                                                                                                            | Applicable Platforms |
+| -------------------------- | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
+| `title`                    | `String`                                 | The title of the authentication prompt.                                                                                                                                                                                | Android, iOS         |
+| `subtitle`                 | `String` (optional)                      | The subtitle of the authentication prompt.                                                                                                                                                                             | Android              |
+| `description`              | `String` (optional)                      | The description of the authentication prompt.                                                                                                                                                                          | Android              |
+| `cancelTitle`              | `String` (optional)                      | The cancel button title of the authentication prompt.                                                                                                                                                                  | Android, iOS         |
+| `evaluationPolicy`         | `LocalAuthenticationStrategy` (optional) | The evaluation policy to use when prompting the user for authentication. Defaults to `deviceOwnerWithBiometrics`.                                                                                                      | iOS                  |
+| `fallbackTitle`            | `String` (optional)                      | The fallback button title of the authentication prompt.                                                                                                                                                                | iOS                  |
+| `authenticationLevel`      | `LocalAuthenticationLevel` (optional)    | The authentication level to use when prompting the user for authentication. Defaults to `strong`.                                                                                                                      | Android              |
+| `deviceCredentialFallback` | `Boolean` (optional)                     | Should the user be given the option to authenticate with their device PIN, pattern, or password instead of a biometric. Defaults to `false`. On iOS this is equivalent to setting `evaluationPolicy` to `deviceOwner`. | Android, iOS         |
 
 > :warning: You need a real device to test Local Authentication for iOS. Local Authentication is not available in simulators.
 

android/src/main/java/com/auth0/react/LocalAuthenticationOptionsParser.kt

@@ -9,7 +9,7 @@ object LocalAuthenticationOptionsParser {
     private const val TITLE_KEY = "title"
     private const val SUBTITLE_KEY = "subtitle"
     private const val DESCRIPTION_KEY = "description"
-    private const val CANCEL_TITLE_KEY = "cancel"
+    private const val CANCEL_TITLE_KEY = "cancelTitle"
     private const val AUTHENTICATION_LEVEL_KEY = "authenticationLevel"
     private const val DEVICE_CREDENTIAL_FALLBACK_KEY = "deviceCredentialFallback"
     private const val BIOMETRIC_POLICY_KEY = "biometricPolicy"
@@ -22,7 +22,8 @@ object LocalAuthenticationOptionsParser {
         val subtitle = map.getString(SUBTITLE_KEY)
         val description = map.getString(DESCRIPTION_KEY)
         val cancelTitle = map.getString(CANCEL_TITLE_KEY)
-        val deviceCredentialFallback = map.getBoolean(DEVICE_CREDENTIAL_FALLBACK_KEY)
+        val deviceCredentialFallback =
+            map.hasKey(DEVICE_CREDENTIAL_FALLBACK_KEY) && map.getBoolean(DEVICE_CREDENTIAL_FALLBACK_KEY)
 
         val builder = LocalAuthenticationOptions.Builder()
             .setTitle(title)

example/android/app/build.gradle

@@ -108,7 +108,7 @@ android {
             // see https://reactnative.dev/docs/signed-apk-android.
             signingConfig signingConfigs.debug
             minifyEnabled enableProguardInReleaseBuilds
-            proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"
+            proguardFiles getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro"
         }
     }
 }

example/android/build.gradle

@@ -5,7 +5,7 @@ buildscript {
         compileSdkVersion = 36
         targetSdkVersion = 36
         ndkVersion = "27.1.12297006"
-        kotlinVersion = "2.1.20"
+        kotlinVersion = "2.2.0"
         // react-native-gesture-handler resolves react-native via a `node --print`
         // fallback that is unreliable in this monorepo layout; pin the location
         // explicitly so its build.gradle skips the fallback.

example/android/gradle.properties

@@ -37,6 +37,11 @@ newArchEnabled=true
 # Use this property to enable or disable the Hermes JS engine.
 # If set to false, you will be using JSC instead.
 hermesEnabled=true
+
+# Opt out of built-in kotlin and new DSL behavior that ships with AGP 9.
+# Starting from AGP 10.x these opt outs will be removed.
+android.builtInKotlin=false
+android.newDsl=false
 
 # Use this property to enable edge-to-edge display support.
 # This allows your app to draw behind system bars for an immersive UI.

example/android/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

example/ios/Auth0Example.xcodeproj/project.pbxproj

@@ -356,7 +356,7 @@
 					"$(inherited)",
 				);
 				INFOPLIST_FILE = Auth0ExampleTests/Info.plist;
-				IPHONEOS_DEPLOYMENT_TARGET = 12.4;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
@@ -379,7 +379,7 @@
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				COPY_PHASE_STRIP = NO;
 				INFOPLIST_FILE = Auth0ExampleTests/Info.plist;
-				IPHONEOS_DEPLOYMENT_TARGET = 12.4;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
@@ -503,7 +503,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 12.4;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
 				LD_RUNPATH_SEARCH_PATHS = (
 					/usr/lib/swift,
 					"$(inherited)",
@@ -581,7 +581,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 12.4;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
 				LD_RUNPATH_SEARCH_PATHS = (
 					/usr/lib/swift,
 					"$(inherited)",