com.squareup.okio:okio transitive dependency has security vulnerability

[lukewpatterson]

From mvn dependency:tree

[INFO] +- com.plaid:plaid-java:jar:17.0.0:compile
[INFO] |  +- com.squareup.okhttp3:okhttp:jar:4.9.3:compile
[INFO] |  |  +- com.squareup.okio:okio:jar:2.8.0:compile

My build report is showing this vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2023-3635

The direct dependency com.squareup.okhttp3:okhttp, which brings in the problematic transitive dependency, looks like it will be releasing a new version very soon which addresses the issue - square/okhttp#8050

According to the vulnerability report, it looks like com.squareup.okio:okio needs to be at least at version 3.4.0.

I just wanted to make sure this was on your radar and was hoping it could be included in the release that fixes the other ticket I just filed #397

[yschimke]

4.12.0 released