JakeWharton
commented
2 years ago Retrofit and Gson are two different libraries with two different versions. You should use the Gson converter version 2.9.0 to go with your Retrofit 2.9.0 but that will use Gson 2.8.5. This is working as expected.
If you want to use a newer version of Gson, add a dependency on it explicitly along with the converter.
In general, we tend to keep our dependency versions low to maximize compatibility rather than always force consumers onto the latest version.
Hi,
Recently we upgraded our gson converter to 2.9.0, but apparently, within that the old 2.8.5 gson library is used. See here: https://github.com/square/retrofit/blob/2.9.0/build.gradle This is problematic because there is an inconsistency regarding the versioning and in 2.8.5 there is a security vulnerability.