chore(deps): upgrade auth0-password-policies to 3.1.0

[ankita10119]

Changes

Upgrades auth0-password-policies from 1.0.2 to 3.1.0 (latest) and password-sheriff from 1.1.1 to 2.0.0.

Background

auth0-password-policies@1.0.2 was published in November 2018. The package was dormant for 7 years and then released 1.1.0 through 3.1.0 in rapid succession between August 2025 and February 2026. Dependabot previously opened PR #2705 targeting 1.1.1 (the first release after the gap), but that PR is stale and was superseded by two further major versions before it could be merged. This PR jumps directly to the current latest.

Why password-sheriff is also bumped:

auth0-password-policies@3.x depends on password-sheriff@^2.0.0. Lock also uses password-sheriff directly (src/field/password.js, src/ui/input/password/password_strength.jsx) via password-sheriff/lib/policy. The lib/policy.js API is identical between v1 and v2 - the only addition is two new built-in rule types (sequentialChars, maxLength) which lock does not use. Bumping lock's direct constraint to ^2.0.0 avoids having two versions of password-sheriff in the install tree.

Why webpack.config.js needed a change:

auth0-password-policies@3.1.0 ships with ES2020 syntax (optional chaining ?.) in its source. The project runs es-check es2017 against the built bundle as a CI gate. The existing webpack babel rule has exclude: node_modules, which means third-party packages are bundled as-is without transpilation. For most packages this is fine since they ship pre-built ES5, but auth0-password-policies does not.

Adding a dedicated babel-loader rule for auth0-password-policies before the main rule handles this. There is one non-obvious subtlety: Babel 7's .babelrc is file-relative, it only applies to files within the same package root and is not used when babel processes files in a different package under node_modules. This means babel would run but apply no transforms, leaving ?. in the output. The fix is to pass presets explicitly in the rule's options alongside configFile: false and
babelrc: false, so babel knows exactly what to do with the file regardless of config file boundaries.

References

Supersedes #2705

Testing

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed
• All relevant assets have been compiled