Changelog for OkHttp 4.9.2

CHANGELOG.md

@@ -1,6 +1,19 @@
 Change Log
 ==========
 
+## Version 4.9.2
+
+_2021-09-30_
+
+ * Fix: Don't include potentially-sensitive header values in `Headers.toString()` or exceptions.
+   This applies to `Authorization`, `Cookie`, `Proxy-Authorization`, and `Set-Cookie` headers.
+ * Fix: Don't crash with an `InaccessibleObjectException` when running on JDK17+ with strong
+   encapsulation enabled.
+ * Fix: Strictly verify hostnames used with OkHttp's `HostnameVerifier`. Programs that make direct
+   manual calls to `HostnameVerifier` could be defeated if the hostnames they pass in are not
+   strictly ASCII. This issue is tracked as [CVE-2021-0341].
+
+
 ## Version 5.0.0-alpha.2
 
 _2021-01-30_
@@ -571,6 +584,7 @@ _2019-06-03_
  [bom]: https://docs.gradle.org/6.2/userguide/platforms.html#sub:bom_import
  [bouncy_castle_releases]: https://www.bouncycastle.org/releasenotes.html
  [dev_server]: https://github.com/square/okhttp/blob/482f88300f78c3419b04379fc26c3683c10d6a9d/samples/guide/src/main/java/okhttp3/recipes/kt/DevServer.kt
+ [CVE-2021-0341]: https://nvd.nist.gov/vuln/detail/CVE-2021-0341
  [fun_interface]: https://kotlinlang.org/docs/reference/fun-interfaces.html
  [graalvm]: https://www.graalvm.org/
  [graalvm_21]: https://www.graalvm.org/release-notes/21_0/

README.md

@@ -99,10 +99,10 @@ Releases
 
 Our [change log][changelog] has release history.
 
-The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/okhttp/4.9.1/jar).
+The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/okhttp/4.9.2/jar).
 
 ```kotlin
-implementation("com.squareup.okhttp3:okhttp:4.9.1")
+implementation("com.squareup.okhttp3:okhttp:4.9.2")
 ```
 
 Snapshot builds are [available][snap]. [R8 and ProGuard][r8_proguard] rules are available.
@@ -112,7 +112,7 @@ Also, we have a [bill of materials (BOM)][bom] available to help you keep OkHttp
 ```kotlin
     dependencies {
        // define a BOM and its version
-       implementation(platform("com.squareup.okhttp3:okhttp-bom:4.9.1"))
+       implementation(platform("com.squareup.okhttp3:okhttp-bom:4.9.2"))
 
        // define any required OkHttp artifacts without version
        implementation("com.squareup.okhttp3:okhttp")
@@ -125,10 +125,10 @@ MockWebServer
 
 OkHttp includes a library for testing HTTP, HTTPS, and HTTP/2 clients.
 
-The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/mockwebserver/4.9.1/jar).
+The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/mockwebserver/4.9.2/jar).
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:mockwebserver:4.9.1")
+testImplementation("com.squareup.okhttp3:mockwebserver:4.9.2")
 ```
 
 GraalVM Native Image

mockwebserver-junit4/README.md

@@ -6,7 +6,7 @@ This module integrates mockwebserver3.MockWebServer with JUnit 4.
 To use, first add this library as a test dependency:
 
 ```
-testImplementation("com.squareup.okhttp3:mockwebserver3-junit4:4.9.1")
+testImplementation("com.squareup.okhttp3:mockwebserver3-junit4:4.9.2")
 ```
 
 Then in tests annotated `@org.junit.Test`, you may declare a field with the `@Rule` annotation:

mockwebserver-junit5/README.md

@@ -6,7 +6,7 @@ This module integrates mockwebserver3.MockWebServer with JUnit 5.
 To use, first add this library as a test dependency:
 
 ```
-testRuntimeOnly("com.squareup.okhttp3:mockwebserver3-junit5:4.9.1")
+testRuntimeOnly("com.squareup.okhttp3:mockwebserver3-junit5:4.9.2")
 ```
 
 Then in tests annotated `@org.junit.jupiter.api.Test`, you may add a [MockWebServer] as a test

mockwebserver/README.md

@@ -142,7 +142,7 @@ server.setDispatcher(dispatcher);
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:mockwebserver:4.9.1")
+testImplementation("com.squareup.okhttp3:mockwebserver:4.9.2")
 ```
 
 ### License

okhttp-brotli/README.md

@@ -14,7 +14,7 @@ OkHttpClient client = new OkHttpClient.Builder()
 ```
 
 ```kotlin
-implementation("com.squareup.okhttp3:okhttp-brotli:4.9.1")
+implementation("com.squareup.okhttp3:okhttp-brotli:4.9.2")
 ```
 
  [1]: https://github.com/google/brotli

okhttp-dnsoverhttps/README.md

@@ -6,7 +6,7 @@ This module is an implementation of [DNS over HTTPS][1] using OkHttp.
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:okhttp-dnsoverhttps:4.9.1")
+testImplementation("com.squareup.okhttp3:okhttp-dnsoverhttps:4.9.2")
 ```
 
 ### Usage

okhttp-logging-interceptor/README.md

@@ -37,7 +37,7 @@ Download
 --------
 
 ```kotlin
-implementation("com.squareup.okhttp3:logging-interceptor:4.9.1")
+implementation("com.squareup.okhttp3:logging-interceptor:4.9.2")
 ```
 
 

okhttp-sse/README.md

@@ -7,5 +7,5 @@ API is not considered stable and may change at any time.
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:okhttp-sse:4.9.1")
+testImplementation("com.squareup.okhttp3:okhttp-sse:4.9.2")
 ```

okhttp-tls/README.md

@@ -227,7 +227,7 @@ Download
 --------
 
 ```kotlin
-implementation("com.squareup.okhttp3:okhttp-tls:4.9.1")
+implementation("com.squareup.okhttp3:okhttp-tls:4.9.2")
 ```
 
  [held_certificate]: https://square.github.io/okhttp/4.x/okhttp-tls/okhttp3.tls/-held-certificate/

okhttp-urlconnection/README.md

@@ -6,5 +6,5 @@ This module integrates OkHttp with `Authenticator` and `CookieHandler` from `jav
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:okhttp-urlconnection:4.9.1")
+testImplementation("com.squareup.okhttp3:okhttp-urlconnection:4.9.2")
 ```