com.squareup.okio:okio transitive dependency has security vulnerability

[lukewpatterson]

From mvn dependency:tree

[INFO] +- com.plaid:plaid-java:jar:17.0.0:compile
[INFO] |  +- com.squareup.okhttp3:okhttp:jar:4.9.3:compile
[INFO] |  |  +- com.squareup.okio:okio:jar:2.8.0:compile

My build report is showing this vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2023-3635

The direct dependency com.squareup.okhttp3:okhttp, which brings in the problematic transitive dependency, looks like it will be releasing a new version very soon which addresses the issue - https://github.com/square/okhttp/issues/8050

According to the vulnerability report, it looks like com.squareup.okio:okio needs to be at least at version 3.4.0.

I just wanted to make sure this was on your radar and was hoping it could be included in the release that fixes the other ticket I just filed https://github.com/plaid/plaid-java/issues/397

[yschimke]

4.12.0 released

[phoenixy1]

A PR has been merged that addresses this and it should be shipped in the next client library release (most likely this month)