Repository navigation
chore(deps): bump okhttp to v5.3.2 - #104
Closed
marcindabrowski wants to merge 1 commit into
Closed
marcindabrowski wants to merge 1 commit into
marcindabrowski wants to merge 1 commit into
Conversation
v5.3.2 is the latest version of okhttp
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| object Versions { | ||
| const val launchdarklyLogging = "1.1.1" | ||
| const val okhttp = "4.12.0" | ||
| const val okhttp = "5.3.2" |
There was a problem hiding this comment.
Kotlin plugin version not updated to match OkHttp 5
High Severity
Bumping OkHttp to 5.3.2 without updating the Kotlin plugin version from 1.6.10 (line 21) creates a major version mismatch. OkHttp 5.3.2 depends on kotlin-stdlib 2.2.21 and requires Kotlin 2.2.0+ to read its metadata. The build file's own comment (lines 32–34) explicitly warns that the Kotlin plugin version must match OkHttp's Kotlin version to avoid extra Kotlin runtime dependencies in the published pom. This mismatch may cause build failures or incorrect transitive dependencies for consumers of this library.
Contributor
|
Hi, thank you for submitting this PR. What is the main driver for updating to v5? We may have to consider how this will roll out with many other dependencies customers may be using. |
|
@tanderson-ld We’d appreciate it if you could take a look at this. Our team uses OkHttp as a direct dependency, and it’s also pulled in transitively through this package, which is causing compatibility issues. |
tanderson-ld
added a commit
that referenced
this pull request
Nov 3, 2026
## Summary Updates OkHttp from 4.12.0 to 5.5.1. This supersedes #104 — thanks @marcindabrowski for getting it started. The version bump itself is one line, but shipping OkHttp 5 correctly required three more changes: - **Kotlin Gradle plugin 1.6.10 → 2.1.21**, matching the Kotlin version OkHttp 5.5.1 is built with (per the kotlin-stdlib dependency in okhttp-jvm's pom). - **Gradle wrapper 7.6 → 7.6.3**, the minimum version the Kotlin plugin 2.1.x accepts (it hard-fails on 7.6). - **Rewrote the plugins-block comment** in `build.gradle.kts`. The 2021 rationale for applying the Kotlin plugin (the `api`-configuration workaround) no longer holds — the build passes without the plugin on Gradle 7.6+. But the plugin is now load-bearing for a different reason, documented in the new comment and below, so it must stay. ## Why this is a breaking change (6.0.0) - OkHttp types appear in this library's public API (`ConnectStrategy.http()` / `HttpConnectStrategy`), so OkHttp's major version is part of our contract. Precedent: the OkHttp 3→4 move shipped as okhttp-eventsource 2.0.0. - **Maven consumers will see a coordinate change.** OkHttp 5.x publishes `com.squareup.okhttp3:okhttp` as an empty Kotlin Multiplatform stub (a 754-byte jar whose pom does not reference the real JVM artifact); only Gradle consumers can resolve it via module metadata. With the Kotlin plugin applied, Gradle writes the resolved `okhttp-jvm:5.5.1` coordinates into our pom — the only functional choice for Maven-only consumers. The tradeoff: a project that also pins `okhttp:4.x` elsewhere in its dependency graph can end up with both jars on the classpath (duplicate classes), since Maven cannot conflict-resolve across different artifact IDs. Gradle consumers are unaffected — our module metadata still declares `okhttp:5.5.1`, and normal version conflict resolution applies. - New transitive dependencies: kotlin-stdlib 2.1.21 and okio 3.18.1. - Platform floors unchanged: Java 8+, Android 5.0+ (API 21+). ## Verification (local, JDK 17) - `./gradlew build`: compile, checkstyle, javadoc, and all 233 unit tests green. No source changes were needed — OkHttp 5 is binary- and source-compatible for the surface this library uses. - `make contract-tests`: all SSE contract tests pass. - Generated pom inspected: depends on `okhttp-jvm:5.5.1`; no kotlin-stdlib leak (still guarded by `kotlin.stdlib.default.dependency=false`). - Generated Gradle module metadata inspected: declares `okhttp:5.5.1`. - Not yet exercised locally: the Java 8 and Windows CI lanes — watch those on this PR. ## Adoption notes for our own SDKs The LaunchDarkly Java and Android SDKs pin their own direct `okhttp` 4.x dependency alongside okhttp-eventsource. When they adopt 6.0.0, they should bump their own OkHttp to 5.x in the same release to avoid the mixed-graph duplicate-class hazard described above. Releasing 6.0.0 forces nothing on existing consumers; the 5.x line keeps working. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **Bumps the transport dependency from OkHttp 4.12.0 to 5.5.1** with no Java source edits in this diff—build and publishing/docs only, intended as a **6.0.0** breaking release because OkHttp types are exposed on the public API (`ConnectStrategy` / `HttpConnectStrategy`). > > **Build toolchain:** Kotlin Gradle plugin **1.6.10 → 2.1.21** (aligned with OkHttp 5’s Kotlin version), Gradle wrapper **7.6 → 7.6.3** plus wrapper script refresh (`gradlew` / `gradlew.bat`, `networkTimeout` on the wrapper). The **`build.gradle.kts` comment** is rewritten to document why the Kotlin plugin must stay: published Maven POMs need resolved **`okhttp-jvm`** coordinates instead of the empty OkHttp 5 **`okhttp`** stub so Maven-only consumers get real classes. > > **README** now states **6.0+ uses OkHttp 5.x** (2.0–5.x stayed on 4.x). Consumers should expect new transitives (e.g. kotlin-stdlib, okio) and possible Maven dependency-graph quirks if they still pin OkHttp 4.x elsewhere. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit afc39fd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Marcin Dąbrowski <marcin.krzysztof.dabrowski@gmail.com>
Contributor
|
Thank you again for motivating this, we bumped to 5.5.1 in #117 and tagged version 6.0.0 to incorporate it. Working on releasing now. Closing as this should be addressed after it releases. Please re-open or log another issue if you run into any issues. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v5.3.2 is the latest version of OkHttp.
Version 5 of OkHttp works on Android 5.0+ (API level 21+) and Java 8+.
Note
Medium Risk
Upgrading the core HTTP client dependency can introduce behavioral/compatibility changes at runtime even though the diff is a single version bump.
Overview
Updates the OkHttp dependency version in
build.gradle.ktsfrom4.12.0to5.3.2, so consumers of this library will build and run against OkHttp v5.Written by Cursor Bugbot for commit 03de884. This will update automatically on new commits. Configure here.