Address CVE-2023-3635

[mateusbandeiraa]

The current version of Okhttp (4.11.0) ships with a vulnerable version of Okio (CVE-2023-3635). I noticed that the current master branch already has a newer version that is not vulnerable.

Please publish a new Okhttp version so the library doesn't ship with a vulnerable dependency anymore.

[yschimke]

Yep, that's the plan.

But it isn't blocking you, you can specify a higher okio version in your build to fix the issue. If it continues to warn it's broken audits.

But release will happen, just when ready.

[yschimke]

Closing as a dupe

[spaultownsend]

Does anyone have a guess when a new 4.x release might be released?

[swankjesse]

I’d like to do a release in the next 7 days.

[yschimke]

4.12.0 released