[dependabot]

Bumps com.squareup.okhttp3:okhttp in /openai-java-bedrock from 4.12.0 to 5.5.0.

Updates com.squareup.okhttp3:okhttp from 4.12.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:okhttp from 4.12.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T15:26:03.226127Z	ff620a5	New commits
🔒 Security Review	✅ Completed 2026-10-27T15:26:37.996654Z	ff620a5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 236/236 SDK tests passed in 15.95s for Java SDK PR #1227.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	591ms
tests/chat-completions-create.test.ts	✅ Passed	379ms
tests/chat-completions-stream.test.ts	✅ Passed	652ms
tests/files-content-binary.test.ts	✅ Passed	291ms
tests/files-create-multipart.test.ts	✅ Passed	402ms
tests/files-list-pagination.test.ts	✅ Passed	237ms
tests/initialize-config.test.ts	✅ Passed	221ms
tests/instance-isolation.test.ts	✅ Passed	216ms
tests/models-list.test.ts	✅ Passed	353ms
tests/responses-background-lifecycle.test.ts	✅ Passed	264ms
tests/responses-body-method-errors.test.ts	✅ Passed	547ms
tests/responses-cancel-timeout.test.ts	✅ Passed	243ms
tests/responses-cancel.test.ts	✅ Passed	296ms
tests/responses-compact-retries.test.ts	✅ Passed	446ms
tests/responses-compact.test.ts	✅ Passed	350ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	445ms
tests/responses-create-advanced.test.ts	✅ Passed	1.549s
tests/responses-create-disconnect.test.ts	✅ Passed	1.199s
tests/responses-create-errors.test.ts	✅ Passed	357ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	265ms
tests/responses-create-retries.test.ts	✅ Passed	381ms
tests/responses-create-stream-failures.test.ts	✅ Passed	1.812s
tests/responses-create-stream-timeout.test.ts	✅ Passed	223ms
tests/responses-create-stream-wire.test.ts	✅ Passed	5.143s
tests/responses-create-stream.test.ts	✅ Passed	162ms
tests/responses-create-terminal-states.test.ts	✅ Passed	505ms
tests/responses-create-timeout.test.ts	✅ Passed	241ms
tests/responses-create.test.ts	✅ Passed	302ms
tests/responses-delete.test.ts	✅ Passed	310ms
tests/responses-input-items-errors.test.ts	✅ Passed	308ms
tests/responses-input-items-list.test.ts	✅ Passed	342ms
tests/responses-input-items-options.test.ts	✅ Passed	314ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	260ms
tests/responses-input-tokens-count.test.ts	✅ Passed	324ms
tests/responses-malformed-inputs.test.ts	✅ Passed	4.017s
tests/responses-not-found-errors.test.ts	✅ Passed	479ms
tests/responses-parse.test.ts	✅ Passed	609ms
tests/responses-retrieve-retries.test.ts	✅ Passed	289ms
tests/responses-retrieve.test.ts	✅ Passed	278ms
tests/responses-stored-method-errors.test.ts	✅ Passed	980ms
tests/retry-behavior.test.ts	✅ Passed	3.738s
tests/sdk-error-shape.test.ts	✅ Passed	461ms

View OkTest run #39229057472

_{SDK merge (d3603b0633b7) · head (f37150ceb1e3) · base (f886d7a12fee) · OkTest (ebbcfaca8a5e)}

[github-actions]

Castiron custom code

Evaluated main: 014f4a2dbb1f2b13655589fe83ba6ef5af4e18b5.

Trusted main policy: 014f4a2dbb1f2b13655589fe83ba6ef5af4e18b5.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared 014f4a2dbb1f → ff620a50ef8b. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 40530960661 --repo openai/openai-java \
  --name castiron-custom-code-40530960661-1 --dir /tmp/castiron-custom-code-40530960661-1
git apply --stat /tmp/castiron-custom-code-40530960661-1/custom-code.patch
cat /tmp/castiron-custom-code-40530960661-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 014f4a2dbb1f2b13655589fe83ba6ef5af4e18b5 ff620a50ef8b32296cef754f9e098188b365ebd5
python3 scripts/castiron/custom_code_report.py report \
  --base 014f4a2dbb1f2b13655589fe83ba6ef5af4e18b5 \
  --head ff620a50ef8b32296cef754f9e098188b365ebd5 --target-branch main --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-ff620a50ef8b
cat /tmp/castiron-custom-code-ff620a50ef8b/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f37150ceb1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Depend on the JVM artifact for Maven consumers

OkHttp 5 publishes com.squareup.okhttp3:okhttp as a multiplatform metadata artifact: Gradle follows its module metadata to okhttp-jvm, but Maven receives an effectively empty JAR whose POM does not redirect to the JVM artifact. Because this declared coordinate is retained in the SDK's generated POM, Maven users of openai-java-client-okhttp (and transitively openai-java-bedrock) will get NoClassDefFoundError for okhttp3 classes when building the client. Use com.squareup.okhttp3:okhttp-jvm:5.5.0 for the published JVM modules, or explicitly rewrite the published POM and cover Maven consumption.

AGENTS.md reference: AGENTS.md:L34-L36

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add the required OkHttp 5 migration ADR

This changes the transport from the OkHttp 4 dependency generation to OkHttp 5, but the commit contains only coordinate updates and a repo-wide search under docs/ finds no corresponding decision record. docs/version-support-policy.md:60-62 requires every material dependency-generation change to have an ADR covering lifecycle evidence, affected artifacts, consumer resolution, migration, SemVer treatment, the final compatible release, and verification; add that ADR before landing this major-generation upgrade.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff620a50ef

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Avoid forcing Android consumers onto compileSdk 37

For Gradle Android consumers, this multiplatform coordinate now selects okhttp-android:5.5.0, whose AAR metadata requires compileSdk 37; applications still compiling against API 36 or earlier therefore fail checkDebugAarMetadata merely by upgrading this SDK. OkHttp's 5.x changelog confirms that Gradle selects a separate Android artifact and that 5.5.0 adds API-37-specific platform support. Preserve an Android-compatible version or explicitly treat and test this as an Android build-floor increase; the current JVM-only compatibility probes select okhttp-jvm and cannot detect it.

Useful? React with 👍 / 👎.