aws-amplify / aws-amplify/amplify-ui-android
🚨 CRITICAL: Authenticator v.1.8.0 and Liveness v1.8.2 + 1.9.0 Deprecated. Update to Authenticator v1.9.0 and Liveness v1.10.0 - Breaking Auth Issue in Transitive Dependency Amplify Android v2.30.3
- Dominant language
- Kotlin
- Stars
- 25
- Forks
- 18
- Avg merge
- 7d 3h
- Merged PRs (30d)
- 1
Description
# 🚨 CRITICAL: Authenticator v.1.8.0 and Liveness v1.8.2 - 1.9.0 Deprecated - Breaking Auth Issue in Transitive Dependency Amplify Android v2.30.3
## **IMMEDIATE ACTION REQUIRED**
**If you are using Authenticator v.1.8.0 or Liveness v1.8.2 - 1.9.0:**
- ❌ **DO NOT release** your app to production
- ⚠️ **Already released?** Update to Authenticator v1.9.0 and Liveness v1.10.0
---
## **What's Happening**
Authenticator v.1.8.0 and Liveness v1.8.2 + 1.9.0 have a transitive dependency on Amplify Android v2.30.3, which contains a **critical authentication bug**. See https://github.com/aws-amplify/amplify-android/issues/3160.
It causes:
- ✗ **Silent session loss** - All users lose authentication when upgrading from Amplify Android v2.30.1 or earlier
- ✗ **No error signals** - No `SessionExpiredException` or `SESSION_EXPIRED` hub events are fired
- ✗ **Bidirectional impact** - Upgrading OR downgrading between affected versions triggers the issue
## **User Impact**
Upon app upgrade, **every authenticated user will:**
1. Be logged out (non-authenticated state - existing credentials cleared)
2. Receive no notification or error about the session loss
3. Need to manually re-authenticate
---
## **Current Status**
- ✅ Bumped Amplify Android dependency of Authenticator and Liveness to a stable version
Contributor guide
Research direction
Start by checking how Authenticator and Liveness declare their Amplify Android dependency, then verify that the versions are updated to Authenticator v1.9.0 and Liveness v1.10.0. Confirm the resulting dependency versions and check the affected authentication upgrade path; done means the deprecated versions and Amplify Android v2.30.3 are no longer pulled in.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100