[Renovate] Update dependency com.squareup.okio:okio to v3 [SECURITY] [MEDIUM]

[appsec-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
com.squareup.okio:okio	dependencies	major	2.9.0 → 3.4.0

---

Okio Signed to Unsigned Conversion Error vulnerability

CVE-2023-3635 / GHSA-w33c-445m-f8w7

More information

Details

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-3635
• https://github.com/square/okio/pull/1280
• https://github.com/square/okio/pull/1334
• https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b
• https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839
• https://github.com/square/okio
• https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176
• https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

lysine-dev/okio (com.squareup.okio:okio)

v3.4.0

2023-07-07

• New: Adapt a Java NIO FileSystem (java.nio.file.FileSystem) as an Okio FileSystem using
  fileSystem.asOkioFileSystem().
• New: Adapt Android’s AssetManager as an Okio FileSystem using AssetFileSystem. This is in the
  new okio-assetfilesystem module. Android applications should prefer this over
  FileSystem.RESOURCES as it’s faster to load.
• Fix: Don't crash decoding GZIP files when the optional extra data (XLEN) is 32 KiB or larger.
• Fix: Resolve symlinks in FakeFileSystem.canonicalize().
• Fix: Report the correct createdAtMillis in NodeJsFileSystem file metadata. We were
  incorrectly using ctimeMs, where c means changed, not created.
• Fix: UnsafeCursor is now Closeable.

v3.3.0

2023-01-07

• Fix: Don't leak resources when use {} is used with a non-local return. We introduced this
  performance and stability bug by not considering that non-local returns execute neither the
  return nor catch control flows.
• Fix: Use a sealed interface for BufferedSink and BufferedSource. These were never intended
  for end-users to implement, and we're happy that Kotlin now allows us to express that in our API.
• New: Change internal locks from synchronized to ReentrantLock and Condition. We expect this
  to improve help when using Okio with Java virtual threads ([Project Loom][loom]).
• Upgrade: [Kotlin 1.8.0][kotlin_1_8_0].

v3.2.0

2022-06-26

• Fix: Configure the multiplatform artifact (com.squareup.okio:okio:3.x.x) to depend on the
  JVM artifact (com.squareup.okio:okio-jvm:3.x.x) for Maven builds. This should work-around an
  issue where Maven doesn't interpret Gradle metadata.
• Fix: Change CipherSource and CipherSink to recover if the cipher doesn't support streaming.
  This should work around a crash with AES/GCM ciphers on Android.
• New: Enable compatibility with non-hierarchical projects.

v3.1.0

2022-04-19

• Upgrade: [Kotlin 1.6.20][kotlin_1_6_20].
• New: Support [Hierarchical project structure][hierarchical_projects]. If you're using Okio in a
  multiplatform project please upgrade your project to Kotlin 1.6.20 (or newer) to take advantage
  of this. With hierarchical projects it's easier to use properties like FileSystem.SYSTEM that
  are available on most Okio platforms but not all of them.
• New: ForwardingSource is now available on all platforms.
• New: The watchosX64 platform is now supported.
• Fix: Don't crash in `NSData.toByteString()' when the input is empty.
• Fix: Support empty ZIP files in FileSystem.openZip().
• Fix: Throw in canonicalize() of ZIP file systems if the path doesn't exist.
• Fix: Don't require ZIP files start with a local file header.
• New: okio.ProtocolException is a new exception type for multiplatform users. (It is aliased to
  java.net.ProtocolException on JVM platforms).

v3.0.0

2021-10-28

This is the first stable release of Okio 3.x. This release is strongly backwards-compatible with
Okio 2.x, and the new major version signifies new capabilities more than it does backwards
incompatibility.

Most users should be able to upgrade from 2.x by just changing the version. If you're using Okio
in a Kotlin Multiplatform project, you'll need to drop the -multiplatform suffix in your Gradle
dependencies.

• New: Remove @ExperimentalFileSystem. This annotation is no longer necessary as the file system
  is no longer experimental!

• New: Path no longer aggressively normalizes .. segments. Use Path.normalize() to apply these
  based on the content of the path, or FileSystem.canonicalize() to do it honoring any symlinks
  on a particular file system.

• New: Publish a [bill of materials (BOM)][bom] for Okio. Depend on this from Gradle or Maven to
  keep all of your Okio artifacts on the same version, even if they're declared via transitive
  dependencies. You can even omit versions when declaring other Okio dependencies.

  dependencies {
     api(platform("com.squareup.okio:okio-bom:3.0.0"))
     api("com.squareup.okio:okio")                // No version!
     api("com.squareup.okio:okio-fakefilesystem") // No version!
  }

• New: FileSystem.delete() silently succeeds when deleting a file that doesn't exist. Use
  the new mustExist parameter to trigger an exception instead.

• New: FileSystem.createDirectories() silently succeeds when creating a directory that already
  exists. Use the new mustCreate parameter to trigger an exception instead.

• New: FileSystem offers Java-language overloads where appropriate. Previously functions that
  had default parameters were potentially awkward to invoke from Java.

• New: Timeout.intersectWith() returns a value instead of Unit. This is a binary-incompatible
  change. We expect that this public API is very rarely used outside of Okio itself.

• Fix: Change BufferedSource.readDecimalLong() to fail if the input value is just -. Previously
  Okio incorrectly returned 0 for this.

v2.10.0

2021-01-07

• New: Support Windows (mingwX64) in multiplatform.
• New: Support watchOS (watchosArm32, watchosArm64, watchosX86) in multiplatform.
• New: Support HashingSource, HashingSink, buffer hash functions, and UnsafeCursor on non-JVM
  platforms. Previously these were all JVM-only.
• New: Implement Closeable on Sink and Source on non-JVM platforms. Okio now includes a
  multiplatform okio.Closeable interface and corresponding use {} extension. Closing resources
  when you're done with them shouldn't be JVM-only!
• New: Sink.hashingSink and Source.hashingSource functions that accept
  java.security.MessageDigest and javax.crypto.Mac instances. Use these when your hash function
  isn't built-in.
• Fix: Don't crash with a ShortBufferException in CipherSink and CipherSource on Android.
  (Android may throw a ShortBufferException even if the buffer is not too short. We now
  avoid this problem!)
• Upgrade: [Kotlin 1.4.20][kotlin_1_4_20].

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.