search

orange-cloudfoundry / cf-ops-automation-broker

On demand dedicated services through COA concourse pipeline engine
4 stars 0 forks source link

Bump okhttp from 3.10.0 to 4.5.0 #265

Closed dependabot-preview[bot] closed 4 years ago

dependabot-preview[bot] commented 4 years ago

Bumps okhttp from 3.10.0 to 4.5.0.

Changelog

Sourced from okhttp's changelog.

Version 4.5.0

2020-04-06

This release fixes a severe bug where OkHttp incorrectly detected and recovered from unhealthy connections. Stale or canceled connections were incorrectly attempted when they shouldn't have been, leading to rare cases of infinite retries. Please upgrade to this release!

  • Fix: don't return stale DNS entries in DnsOverHttps. We were caching DNS results indefinitely rather than the duration specified in the response's cache-control header.
  • Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate containing an IP address we must match that address against the URL's IP address, even when the two addresses are encoded differently, such as 192.168.1.1 and 0::0:0:FFFF:C0A8:101. Note that OkHttp incorrectly rejected valid certificates resulting in a failure to connect; at no point were invalid certificates accepted.
  • New: OkHttpClient.Builder.minWebSocketMessageToCompress() configures a threshold for compressing outbound web socket messages. Configure this with 0L to always compress outbound messages and Long.MAX_VALUE to never compress outbound messages. The default is 1024L which compresses messages of size 1 KiB and larger. (Inbound messages are compressed or not based on the web socket server's configuration.)
  • New: Defer constructing Inflater and Deflater instances until they are needed. This saves memory if web socket compression is negotiated but not used.

Version 4.5.0-RC1

2020-03-17

This release candidate turns on web socket compression.

The [spec][rfc_7692] includes a sophisticated mechanism for client and server to negotiate compression features. We strive to offer great performance in our default configuration and so we're making compression the default for everyone starting with this release candidate.

Please be considerate of your servers and their operators as you roll out this release. Compression saves bandwidth but it costs CPU and memory! If you run into a problem you may need to adjust or disable the permessage-deflate compression settings on your server.

Note that OkHttp won't use compression when sending messages smaller than 1 KiB.

  • Fix: Don't crash when the URL hostname contains an underscore on Android.
  • Fix: Change HTTP/2 to use a daemon thread for its socket reader. If you've ever seen a command line application hang after all of the work is done, it may be due to a non-daemon thread like this one.
  • New: Include suppressed exceptions when all routes to a target service fail.

Version 4.4.1

2020-03-08

... (truncated)
Commits
  • ca0c8d6 Prepare for release 4.5.0.
  • c1150b0 Merge pull request #5920 from square/health-raw-socket
  • 11ee29c Flag connection as unhealthy when underlying socket is closed.
  • 46fcf4f Fix for infinite caching in DoH (#5918)
  • 7b07635 Defer class initialization to avoid spamming on Conscrypt errors (not for lan...
  • 3414fe4 Close Android test properly in case it passes (#5905)
  • b7a41a9 Merge pull request #5913 from pau101/document-close-reason
  • 7e2922e Document maximum close reason length
  • 4c1f65d Merge pull request #5908 from yschimke/alpnz2
  • 4a753e7 New JDK 8 version for ALPN
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)
dependabot-preview[bot] commented 4 years ago

Superseded by #270.