search

square / retrofit

A type-safe HTTP client for Android and the JVM
https://square.github.io/retrofit/
Apache License 2.0
43.11k stars 7.3k forks source link

Vulnerability Detected #4211

Closed robel-aredo-kr closed 3 months ago

robel-aredo-kr commented 3 months ago

The latest version of retrofit currently uses com.squareup.okhttp3 version 3.14.9 which flags an Information Exposure Vulnerability in Snyk: https://security.snyk.io/vuln/SNYK-JAVA-COMSQUAREUPOKHTTP3-2958044

Upgrading the version to 4.9.2 will fix the issue, as stated in the Snyk link.

JakeWharton commented 3 months ago

We are not upgrading OkHttp at this time. See https://github.com/square/retrofit/issues/4020#issuecomment-1870586604 for the plan.

You are welcome to upgrade the version of OkHttp in your builds.