Upgrade transitive dependencies of retrofit to address vulns

gocd-contrib · May 17, 2024 · c7db023 · c7db023
1 parent 7edf2f0
commit c7db023
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/dependencies.gradle b/dependencies.gradle
@@ -38,6 +38,7 @@ final Map<String, String> libraries = [
   junitJupiterApi   : 'org.junit.jupiter:junit-jupiter-api:5.10.2',
   lombok            : 'org.projectlombok:lombok:1.18.32',
   mockito           : 'org.mockito:mockito-core:5.12.0',
+  okio              : 'com.squareup.okio:okio:1.17.6',
   pluginApi         : 'cd.go.plugin:go-plugin-api:24.1.0',
   reflections       : 'org.reflections:reflections:0.10.2',
   retrofit          : 'com.squareup.retrofit2:retrofit:2.11.0',

diff --git a/providers/build.gradle b/providers/build.gradle
@@ -25,6 +25,10 @@ dependencies {
   implementation project.deps.commonsLang
   implementation project.deps.retrofit
   implementation project.deps.retrofitJacksonConv
+  constraints {
+    // Force upgrade transitive dependencies of fabric client to versions without vulnerabilities
+    implementation project.deps.okio
+  }
   implementation project.deps.validateApi
 
   testImplementation project.deps.junitJupiterApi