Skip to content

fix(dependency): publish patched Okio dependency - #123

Open
317787106 wants to merge 3 commits into
tronprotocol:release-v2.3.0from
317787106:feature/update_dependency_okio
Open

317787106 wants to merge 3 commits into
tronprotocol:release-v2.3.0from
317787106:feature/update_dependency_okio

Conversation

@317787106

@317787106 317787106 commented Oct 30, 2025

Copy link
Copy Markdown
Contributor

What does this PR do?

  • Declare com.squareup.okio:okio:1.17.6 as an implementation dependency to address CVE-2023-3635 in the Aliyun SDK HTTP dependency chain.
  • Include the patched version in the published Maven POM and Gradle Module Metadata so downstream consumers can resolve it.
  • Include dependency verification checksums for Okio 1.17.6.

Why are these changes required?

Aliyun DNS publishing uses Okio through the Tea SDK and OkHttp. Excluding Okio breaks that runtime path, so the dependency needs to be upgraded while preserving SDK functionality.

A resolutionStrategy.force rule only affects dependency resolution in the current build. Publishing an explicit dependency makes the patched version available to consumers such as java-tron through the library's dependency metadata.

This PR has been tested by:

  • All 14 targeted DNS tests passed locally: AlgorithmTest, TreeTest, LinkCacheTest, DnsNodeTest, and AwsRoute53Test.
  • Published the library to an isolated local Maven repository and confirmed that the POM and Gradle Module Metadata declare Okio 1.17.6.
  • Verified that independent consumer projects resolve Okio 1.17.6 through both Gradle Module Metadata and POM-only resolution, without consumer-side version overrides.
  • Used the published dependency graph to run an Aliyun DNS SDK request against a loopback HTTP server with test credentials; the gzip-compressed response was decoded successfully.
  • git diff --check passed.

Follow up

Confirm the resolved Okio version when integrating the updated libp2p release into java-tron.

Extra details

Okio 1.17.6 contains the CVE-2023-3635 fix for the 1.x line and does not introduce a Kotlin dependency. CVE-2020-15250 concerns JUnit and is outside the scope of this Okio update; libp2p declares JUnit 4.13.2 for tests.

@xxo1shine

Copy link
Copy Markdown
Contributor

The branch has been out of sync for too long. I suggest creating a new branch and merging the changes into the latest branch.

@317787106

Copy link
Copy Markdown
Contributor Author

@xxo1shine OK, i will create a new PR.

@317787106
317787106 changed the base branch from release-v2.2.7 to main September 9, 2026 10:54
@317787106

Copy link
Copy Markdown
Contributor Author

@xxo1shine I have udpdate this PR.

@317787106 317787106 changed the title feat(dependency): bump indirect dependency com.squareup.okio/okio from 1.15.0 to 1.17.6 feat(dependency): bump indirect dependency com.squareup.okio:okio to 1.17.6 Sep 9, 2026
@317787106 317787106 changed the title feat(dependency): bump indirect dependency com.squareup.okio:okio to 1.17.6 fix(dependency): publish patched Okio dependency Sep 11, 2026
@317787106
317787106 changed the base branch from main to release-v2.3.0 September 15, 2026 04:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants