From 05f302c8c14c79be6f1b3f9a49e4bd8df1cafb57 Mon Sep 17 00:00:00 2001
From: Joe Di Pol <joe.dipol@oracle.com>
Date: Tue, 3 Oct 2023 16:16:52 -0700
Subject: [PATCH 1/2] Upgrade okhttp3 and okio. Use OCI BOM

---
 dependencies/pom.xml             | 758 +------------------------------
 tracing/providers/jaeger/pom.xml |  23 +
 2 files changed, 28 insertions(+), 753 deletions(-)

diff --git a/dependencies/pom.xml b/dependencies/pom.xml
index 00321407574..f5e70f0ebe7 100644
--- a/dependencies/pom.xml
+++ b/dependencies/pom.xml
@@ -131,9 +131,10 @@
         <version.lib.netty-io_uring>0.0.8.Final</version.lib.netty-io_uring>
         <version.lib.oci>3.21.0</version.lib.oci>
         <version.lib.ojdbc8>21.3.0.0</version.lib.ojdbc8>
-        <version.lib.okhttp3>3.14.9</version.lib.okhttp3>
-        <!-- Force upgrade to more current version -->
+        <!-- Force upgrade okio for CVE-2023-0833. When okhttp 4.12.0 is available we can remove this -->
         <version.lib.okio>3.4.0</version.lib.okio>
+        <!-- Force upgrade okhttp3 for CVE-2023-0833 -->
+        <version.lib.okhttp3>4.11.0</version.lib.okhttp3>
         <version.lib.opentelemetry.semconv>1.22.0-alpha</version.lib.opentelemetry.semconv>
         <version.lib.opentelemetry-sdk-extension-autoconfigure>1.22.0-alpha</version.lib.opentelemetry-sdk-extension-autoconfigure>
         <version.lib.opentelemetry.opentracing.shim>1.22.0-alpha</version.lib.opentelemetry.opentracing.shim>
@@ -1245,20 +1246,14 @@
                     </exclusion>
                 </exclusions>
             </dependency>
-            <!-- 4.x versions cause problems with native-image This is used by jaeger-client -->
             <dependency>
+                <!-- Force upgrade okhttp3 for CVE-2023-0833 -->
                 <groupId>com.squareup.okhttp3</groupId>
                 <artifactId>okhttp</artifactId>
                 <version>${version.lib.okhttp3}</version>
             </dependency>
             <dependency>
-                <!-- required for dependency convergence
-                used from both
-                com.squareup.okhttp3:mockwebserver:3.13.1
-                com.squareup.moshi:moshi:1.8.0
-                both referenced by
-                io.zipkin.zipkin2:zipkin-junit:2.12.5
-                -->
+                <!-- Force upgrade okio for CVE-2023-0833. When okhttp 4.12.0 is available we can remove this -->
                 <groupId>com.squareup.okio</groupId>
                 <artifactId>okio</artifactId>
                 <version>${version.lib.okio}</version>
@@ -1412,8 +1407,6 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- OCI BOM omitted due to https://github.com/oracle/oci-java-sdk/issues/432 -->
-            <!--
             <dependency>
                 <groupId>com.oracle.oci.sdk</groupId>
                 <artifactId>oci-java-sdk-bom</artifactId>
@@ -1421,747 +1414,6 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            -->
-
-            <!-- OCI BOM contents inlined below to work around https://github.com/oracle/oci-java-sdk/issues/432 -->
-
-            <!-- Common packages -->
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-circuitbreaker</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-common</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-common-httpclient-jersey3</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <!-- Service modules, alpha sorted -->
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-audit</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-containerengine</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-core</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-database</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-dns</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-email</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-filestorage</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-identity</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-loadbalancer</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-objectstorage</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-addons-resteasy-client-configurator</artifactId>
-              <version>${version.lib.oci}</version>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-addons-sasl</artifactId>
-              <version>${version.lib.oci}</version>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-addons-graalvm</artifactId>
-              <version>${version.lib.oci}</version>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-resourcesearch</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-addons-apache</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-keymanagement</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-announcementsservice</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-healthchecks</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-waas</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-streaming</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-resourcemanager</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-monitoring</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-ons</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-autoscaling</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-budget</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-workrequests</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-limits</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-functions</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-events</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-dts</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-oce</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-oda</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-analytics</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-integration</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-osmanagement</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-marketplace</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-apigateway</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-applicationmigration</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-datacatalog</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-dataflow</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-datascience</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-nosql</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-secrets</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-vault</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-bds</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-encryption</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-cims</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-datasafe</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-mysql</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-dataintegration</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-ocvp</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-usageapi</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-blockchain</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-loggingingestion</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-logging</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-loganalytics</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-managementdashboard</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-sch</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-loggingsearch</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-managementagent</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-cloudguard</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-opsi</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-computeinstanceagent</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-optimizer</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-tenantmanagercontrolplane</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-rover</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-databasemanagement</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-artifacts</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-apmsynthetics</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-goldengate</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-apmcontrolplane</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-apmtraces</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-networkloadbalancer</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-vulnerabilityscanning</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-databasemigration</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-servicecatalog</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-ailanguage</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-operatoraccesscontrol</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-bastion</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-genericartifactscontent</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-jms</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-devops</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-aianomalydetection</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-datalabelingservice</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-datalabelingservicedataplane</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-apmconfig</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-waf</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-certificates</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-certificatesmanagement</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-usage</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-databasetools</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-servicemanagerproxy</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-appmgmtcontrol</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-ospgateway</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-identitydataplane</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-visualbuilder</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-osubusage</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-osubsubscription</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-osuborganizationsubscription</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-osubbillingschedule</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-dashboardservice</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-threatintelligence</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-aivision</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-aispeech</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-dataconnectivity</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-stackmonitoring</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-servicemesh</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-adm</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-licensemanager</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-onesubscription</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-governancerulescontrolplane</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-waa</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-networkfirewall</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-vnmonitoring</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-emwarehouse</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-lockbox</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-fusionapps</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-mediaservices</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-opa</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
-            <dependency>
-              <groupId>com.oracle.oci.sdk</groupId>
-              <artifactId>oci-java-sdk-opensearch</artifactId>
-              <version>${version.lib.oci}</version>
-              <optional>false</optional>
-            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/tracing/providers/jaeger/pom.xml b/tracing/providers/jaeger/pom.xml
index 3d4fd930ebd..7843567a5b7 100644
--- a/tracing/providers/jaeger/pom.xml
+++ b/tracing/providers/jaeger/pom.xml
@@ -41,9 +41,31 @@
             <groupId>io.opentelemetry</groupId>
             <artifactId>opentelemetry-sdk</artifactId>
         </dependency>
+        <!-- For dependency convergence of kotlin-stdlib -->
+        <!-- We force upgrade of okio because of CVE-2023-3635 -->
+        <!-- But okhttp3 depends on older version of kotlin-stdlib -->
+        <!-- we defer to version in okio, so must exclude it from okhttp3 -->
+        <!-- which is a transitive dependency of export-jaeger -->
+        <!-- Once okhttp3 4.12.0 is released we can remove this since it upgrades okio -->
+        <!-- https://github.com/square/okhttp/pull/7947 -->
+        <dependency>
+            <groupId>com.squareup.okio</groupId>
+            <artifactId>okio</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.opentelemetry</groupId>
             <artifactId>opentelemetry-exporter-jaeger</artifactId>
+            <exclusions>
+                <!-- For dependency convergence. See comment on okio -->
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-jdk8</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.helidon.tracing.providers</groupId>
@@ -90,6 +112,7 @@
             <artifactId>helidon-config-metadata-processor</artifactId>
             <optional>true</optional>
         </dependency>
+
         <!--
          - Test dependencies
          -->

From ecebefcb7496e1885a7fd42c2a37393607bf0c2d Mon Sep 17 00:00:00 2001
From: Joe Di Pol <joe.dipol@oracle.com>
Date: Wed, 4 Oct 2023 09:57:06 -0700
Subject: [PATCH 2/2] Don't dependency manage kotlin. Fix typo.

---
 dependencies/pom.xml             | 11 ++---------
 tracing/providers/jaeger/pom.xml | 18 +++++-------------
 2 files changed, 7 insertions(+), 22 deletions(-)

diff --git a/dependencies/pom.xml b/dependencies/pom.xml
index f5e70f0ebe7..2a49733bf75 100644
--- a/dependencies/pom.xml
+++ b/dependencies/pom.xml
@@ -95,7 +95,6 @@
         <version.lib.jgit>6.7.0.202309050840-r</version.lib.jgit>
         <version.lib.junit>5.9.3</version.lib.junit>
         <version.lib.kafka>3.5.1</version.lib.kafka>
-        <version.lib.kotlin>1.8.0</version.lib.kotlin>
         <version.lib.log4j>2.18.0</version.lib.log4j>
         <version.lib.logback>1.4.0</version.lib.logback>
         <version.lib.mariadb-java-client>2.6.2</version.lib.mariadb-java-client>
@@ -131,7 +130,7 @@
         <version.lib.netty-io_uring>0.0.8.Final</version.lib.netty-io_uring>
         <version.lib.oci>3.21.0</version.lib.oci>
         <version.lib.ojdbc8>21.3.0.0</version.lib.ojdbc8>
-        <!-- Force upgrade okio for CVE-2023-0833. When okhttp 4.12.0 is available we can remove this -->
+        <!-- Force upgrade okio for CVE-2023-3635. When okhttp 4.12.0 is available we can remove this -->
         <version.lib.okio>3.4.0</version.lib.okio>
         <!-- Force upgrade okhttp3 for CVE-2023-0833 -->
         <version.lib.okhttp3>4.11.0</version.lib.okhttp3>
@@ -946,12 +945,6 @@
                 <artifactId>kafka-clients</artifactId>
                 <version>${version.lib.kafka}</version>
             </dependency>
-            <dependency>
-                <!-- required transitively by okhttp (used in OpenTelemetry through Jaeger) -->
-                <artifactId>kotlin-stdlib</artifactId>
-                <groupId>org.jetbrains.kotlin</groupId>
-                <version>${version.lib.kotlin}</version>
-            </dependency>
             <dependency>
                 <groupId>org.glassfish.jersey.media</groupId>
                 <artifactId>jersey-media-json-binding</artifactId>
@@ -1253,7 +1246,7 @@
                 <version>${version.lib.okhttp3}</version>
             </dependency>
             <dependency>
-                <!-- Force upgrade okio for CVE-2023-0833. When okhttp 4.12.0 is available we can remove this -->
+                <!-- Force upgrade okio for CVE-2023-3635. When okhttp 4.12.0 is available we can remove this -->
                 <groupId>com.squareup.okio</groupId>
                 <artifactId>okio</artifactId>
                 <version>${version.lib.okio}</version>
diff --git a/tracing/providers/jaeger/pom.xml b/tracing/providers/jaeger/pom.xml
index 7843567a5b7..664cd30382c 100644
--- a/tracing/providers/jaeger/pom.xml
+++ b/tracing/providers/jaeger/pom.xml
@@ -41,13 +41,9 @@
             <groupId>io.opentelemetry</groupId>
             <artifactId>opentelemetry-sdk</artifactId>
         </dependency>
-        <!-- For dependency convergence of kotlin-stdlib -->
-        <!-- We force upgrade of okio because of CVE-2023-3635 -->
-        <!-- But okhttp3 depends on older version of kotlin-stdlib -->
-        <!-- we defer to version in okio, so must exclude it from okhttp3 -->
-        <!-- which is a transitive dependency of export-jaeger -->
-        <!-- Once okhttp3 4.12.0 is released we can remove this since it upgrades okio -->
-        <!-- https://github.com/square/okhttp/pull/7947 -->
+        <!-- For dependency convergence of kotlin-stdlib
+             Once okhttp3 4.12.0 is released we can remove this since it upgrades okio
+             https://github.com/square/okhttp/pull/7947 -->
         <dependency>
             <groupId>com.squareup.okio</groupId>
             <artifactId>okio</artifactId>
@@ -56,7 +52,8 @@
             <groupId>io.opentelemetry</groupId>
             <artifactId>opentelemetry-exporter-jaeger</artifactId>
             <exclusions>
-                <!-- For dependency convergence. See comment on okio -->
+                <!-- For dependency convergence. This excludes the transitive dep
+                     on kotlin from okhttp. We defer to the transitive dep from okio -->
                 <exclusion>
                     <groupId>org.jetbrains.kotlin</groupId>
                     <artifactId>kotlin-stdlib-jdk8</artifactId>
@@ -87,11 +84,6 @@
             <groupId>io.helidon.tracing</groupId>
             <artifactId>helidon-tracing</artifactId>
         </dependency>
-        <dependency>
-            <!-- used by okhttp in OpenTelemetry exporter -->
-            <artifactId>kotlin-stdlib</artifactId>
-            <groupId>org.jetbrains.kotlin</groupId>
-        </dependency>
         <dependency>
             <!-- redirecting Jaeger slf4j logging to JUL logging -->
             <groupId>org.slf4j</groupId>