Release 0.11.1

[anirudh3997]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

This PR prepares the 0.11.1 release of the Guardian Android SDK. It bumps the version in .version from 0.11.0 to 0.11.1 and adds the corresponding CHANGELOG.md entry.

0.11.1 is a patch release that ships the fix already merged to master in #151: RichConsentsAPIClient previously signed the DPoP assertion by casting the enrollment PrivateKey to java.security.interfaces.RSAPrivateKey. Hardware-backed Android Keystore keys (AndroidKeyStoreRSAPrivateKey) do not implement that interface, so fetching a rich consent crashed with a ClassCastException for any enrollment whose key lives in the Android Keystore. The fix signs the assertion via java.security.Signature ("SHA256withRSA"), which accepts any PrivateKey.

No API changes, no breaking changes. The signing change is backwards compatible: Signature.initSign(PrivateKey) works for both hardware-backed Keystore keys and plain in-memory RSA keys, so existing enrollments continue to work unchanged. This PR itself contains only the version bump and changelog — the code fix landed in #151.

References

• Fix PR: ESD-66431: Fix rich consent signing with Android Keystore keys #151
• Jira: ESD-66431

Testing

The fix in #151 added a regression test, RichConsentsAPIClientTest#shouldFetchRichConsentWithKeystorePrivateKey, which fails with ClassCastException on the pre-fix code and passes with the fix.

Reviewers can verify:

• Run ./gradlew :guardian:testDebugUnitTest — all RichConsentsAPIClientTest cases pass, including the Keystore regression test.
• Confirm .version reads 0.11.1 and the CHANGELOG.md entry matches.

Beyond unit tests, the fix was validated end-to-end on a physical Android device against the production Guardian app: the crash was reproduced on the pre-fix SDK (AndroidKeyStoreRSAPrivateKey cannot be cast to RSAPrivateKey), and with the patched SDK the rich-consent request was signed and reached the server successfully — no crash.

Developed on: Android SDK (Java), Gradle 8.13 / AGP 8.12.2, JDK 17 (Corretto 17), Robolectric unit tests on @config(sdk = 23).

• This change adds test coverage for new/changed/fixed functionality (added in ESD-66431: Fix rich consent signing with Android Keystore keys #151)

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs (CHANGELOG.md entry)
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[manigandanparthasarathi-okta]

LGTM