aws-amplify / aws-amplify/amplify-ui-android

🚨 CRITICAL: Authenticator v.1.8.0 and Liveness v1.8.2 + 1.9.0 Deprecated. Update to Authenticator v1.9.0 and Liveness v1.10.0 - Breaking Auth Issue in Transitive Dependency Amplify Android v2.30.3

Open
#300 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Kotlin
Stars
25
Forks
18
Avg merge
7d 3h
Merged PRs (30d)
1

Description

# 🚨 CRITICAL: Authenticator v.1.8.0 and Liveness v1.8.2 - 1.9.0 Deprecated - Breaking Auth Issue in Transitive Dependency Amplify Android v2.30.3

## **IMMEDIATE ACTION REQUIRED**

**If you are using Authenticator v.1.8.0 or Liveness v1.8.2 - 1.9.0:**
- ❌ **DO NOT release** your app to production
- ⚠️ **Already released?** Update to Authenticator v1.9.0 and Liveness v1.10.0

---

## **What's Happening**

Authenticator v.1.8.0 and Liveness v1.8.2 + 1.9.0 have a transitive dependency on Amplify Android v2.30.3, which contains a **critical authentication bug**. See https://github.com/aws-amplify/amplify-android/issues/3160.

It causes:

- ✗ **Silent session loss** - All users lose authentication when upgrading from Amplify Android v2.30.1 or earlier
- ✗ **No error signals** - No `SessionExpiredException` or `SESSION_EXPIRED` hub events are fired
- ✗ **Bidirectional impact** - Upgrading OR downgrading between affected versions triggers the issue

## **User Impact**

Upon app upgrade, **every authenticated user will:**
1. Be logged out (non-authenticated state - existing credentials cleared)
2. Receive no notification or error about the session loss
3. Need to manually re-authenticate

---

## **Current Status**

- ✅ Bumped Amplify Android dependency of Authenticator and Liveness to a stable version

Contributor guide

Open the contributing guide

Research direction

Start by checking how Authenticator and Liveness declare their Amplify Android dependency, then verify that the versions are updated to Authenticator v1.9.0 and Liveness v1.10.0. Confirm the resulting dependency versions and check the affected authentication upgrade path; done means the deprecated versions and Amplify Android v2.30.3 are no longer pulled in.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.