dependency updates for 4.x stopped in 2023?

[rriemann]

Dears,

First of all, let me thank you for the effort you put into okhttp!

Our project relies currently on 4.12.0 released in 2023: https://lysine.dev/okhttp/changelogs/changelog_4x/

I understand from https://lysine.dev/okhttp/security/security/ that EOL of 4.x is only in about one year in 2027.

At the same time, 5.x receives in its regular minor/patch releases dependency version bumps, that I do not see for 4.x since July 2023 (#7947).

I hear that questions are not for the Github bug tracker. So please read this as an issue request on possibly outdated EOL information on https://lysine.dev/okhttp/security/security/ 🙂 .

[yschimke]

Are there some version bumps that we should be aware of for security reasons?

I realise there are some simplistic security scanners that see OkHttp using some older version of libraries and flag that as a security alert. But if we try to play whack-a-mole with those, we will have more releases on 4.x than we typically have on 5.x.

I guess the expectation is that unless there is some breaking change due to security issues, that you can mostly bump the versions of dependencies as needed.