Update Okio to resolve CVE-2023-3635 (#560)

auth0 · Sep 20, 2023 · 224a488 · 224a488
1 parent 4cd3b3a
commit 224a488
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/build.gradle b/build.gradle
@@ -70,7 +70,12 @@ ext {
 }
 
 dependencies {
-    implementation "com.squareup.okhttp3:okhttp:${okhttpVersion}"
+    // TODO remove direct dependency when OkHttp 4.12.0 is released
+    implementation ("com.squareup.okhttp3:okhttp:${okhttpVersion}") {
+      exclude group: 'com.squareup.okhttp3', module: 'okio'
+    }
+    implementation "com.squareup.okio:okio:3.5.0"
+
     implementation "com.squareup.okhttp3:logging-interceptor:${okhttpVersion}"
     implementation "com.fasterxml.jackson.core:jackson-databind:2.14.2"
     implementation "com.auth0:java-jwt:4.4.0"