Skip to content

Commit 428a7d4

Browse files
committed
Update com.squareup.okio:okio to 3.4.0
Use okio 3.4.0 explicity to fix vulnerability introduced through okhttp3 (3.3.0). See https://www.cve.org/CVERecord?id=CVE-2023-3635 for more details on the vulnerability.
1 parent 96a7cc2 commit 428a7d4

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

app/build.gradle

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,9 @@ dependencies {
244244

245245
// HTTP client
246246
implementation "com.squareup.okhttp3:okhttp:4.11.0"
247+
// okhttp3:4.11.0 introduces a vulnerability from com.squareup.okio:okio@3.3.0,
248+
// remove com.squareup.okio:okio when updating okhttp
249+
implementation "com.squareup.okio:okio:3.4.0"
247250

248251
// Media player
249252
implementation "com.google.android.exoplayer:exoplayer-core:${exoPlayerVersion}"

0 commit comments

Comments
 (0)