Force Okio upgrade to 3.6.0 to avoid CVE-2023-3635

Not actually susceptible to this CVE because we don't use GzipSource, but this at least removes the vulnerability warning.
christiandeange · Nov 3, 2023 · 77481ac · 77481ac
1 parent 439f09a
commit 77481ac
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/generator/build.gradle.kts b/generator/build.gradle.kts
@@ -18,6 +18,8 @@ dependencies {
   api(libs.moshi)
   api(libs.moshi.adapters)
 
+  implementation(libs.okio)
+
   ksp(libs.moshi.codegen)
 }
 

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -39,6 +39,7 @@ kotlinpoet = { module = "com.squareup:kotlinpoet", version = "1.14.2" }
 moshi = { module = "com.squareup.moshi:moshi", version.ref = "moshi" }
 moshi-adapters = { module = "com.squareup.moshi:moshi-adapters", version.ref = "moshi" }
 moshi-codegen = { module = "com.squareup.moshi:moshi-kotlin-codegen", version.ref = "moshi" }
+okio = { module = "com.squareup.okio:okio", version = "3.6.0" }
 
 kotlinx-abi = { module = "org.jetbrains.kotlinx:binary-compatibility-validator", version.ref = "kotlinx-abi-plugin" }
 kotlinx-atomicfu = { module = "org.jetbrains.kotlinx:atomicfu", version = "0.22.0" }