mobile-dev-inc / mobile-dev-inc/dadb
Upgrade okio dependency to the latest
Open
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 1.2k
- Forks
- 102
- PR merge metrics
- No merged PRs in 30d
Description
After adding dadb dependency, got following warning
Provides transitive vulnerable dependency maven:com.squareup.okio:okio:2.10.0
CVE-2023-3635 7.5 Incorrect Conversion between Numeric Types vulnerability with High severity found
It appears we can safely update to okio 3.x (https://github.com/square/okio/issues/982)
Any particular reason for sticking to an old release?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the project’s dependency declarations to find where okio 2.10.0 is introduced. Check compatibility with okio 3.x, then verify that the vulnerable transitive dependency warning is no longer reported and the existing project checks still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100