Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Okio to resolve CVE-2023-3635 #687

Merged
merged 6 commits into from
Oct 3, 2023
Merged

Update Okio to resolve CVE-2023-3635 #687

merged 6 commits into from
Oct 3, 2023

Conversation

jimmyjames
Copy link
Contributor

@jimmyjames jimmyjames commented Sep 20, 2023

Excludes transient dependency okio from OkHttp and include 3.5.0 which resolves CVE-2023-3635. Once OkHttp 4.12.0 is released we can remove the manual okio dependency and exclude rule.

This change also updates the Kotlin version to 1.8, as Okio requires it beyond 3.2.0, as well as the Gradle version to 6.9.3

@jimmyjames jimmyjames requested a review from a team as a code owner September 20, 2023 17:11
evansims
evansims previously approved these changes Sep 21, 2023
@poovamraj poovamraj temporarily deployed to internal September 25, 2023 09:21 — with GitHub Actions Inactive
@poovamraj poovamraj temporarily deployed to internal September 25, 2023 09:21 — with GitHub Actions Inactive
@jimmyjames
Copy link
Contributor Author

@evansims any idea why the snyk check is failing? It's unable to find a JAVA_HOME when executing gradle, and I notice the snyk runner is set to use the php one, is that correct? Also I don't see that workflow having run as part of the initial PR to add GH actions. Looks like the same issue is also blocking #690

@jimmyjames jimmyjames temporarily deployed to internal September 27, 2023 01:35 — with GitHub Actions Inactive
@jimmyjames jimmyjames temporarily deployed to internal September 27, 2023 01:35 — with GitHub Actions Inactive
@poovamraj poovamraj temporarily deployed to internal October 2, 2023 14:55 — with GitHub Actions Inactive
@poovamraj poovamraj temporarily deployed to internal October 2, 2023 14:55 — with GitHub Actions Inactive
@poovamraj poovamraj enabled auto-merge (squash) October 3, 2023 06:02
@poovamraj poovamraj merged commit 819c331 into main Oct 3, 2023
13 checks passed
@poovamraj poovamraj deleted the update-okhttp branch October 3, 2023 06:03
@poovamraj poovamraj mentioned this pull request Oct 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants