fix(deps): update okhttp.version to v5.5.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.squareup.okhttp3:mockwebserver (source)	5.1.0 → 5.5.0
com.squareup.okhttp3:okhttp-jvm (source)	5.1.0 → 5.5.0
com.squareup.okhttp3:okhttp (source)	5.1.0 → 5.5.0

---

Release Notes

lysine-dev/okhttp (com.squareup.okhttp3:mockwebserver)

v5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature
improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s
Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re
looking at. With ECH, the router observes only the IP address. This additional privacy is most
effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37,
released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the
[HTTPS resource record], and we needed to write new code to fetch these records. This release
includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not
just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()

// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
  .dns(DnsOverHttps.Builder()
    .client(bootstrapClient)
    .url("https://1.1.1.1/dns-query".toHttpUrl())
    .build())
  .build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are
deficient because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts is now signed with our [new signing key]. This project and three sibling
  projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts
  weren’t applied correctly.
• Fix: Follow [RFC 1008]'s requirements for HTTP QUERY redirects.
• Fix: Fall back to no proxy when the system proxy selector throws. Previously this would cause
  the HTTP call to crash.
• Upgrade: [Okio 3.18.1][okio_3_18_1].

v5.4.0

2026-06-08

• New: Add superpowers to interceptors. Interceptors can now override anything settable on
  OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect
  this will allow most users to use interceptors everywhere, insted of mixing and matching
  interceptors with custom Call.Factory wrappers.
• Fix: Limit each HTTP/2 response to 256 KiB of total headers.
• Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional
  okhttp-coroutines artifact.
• Upgrade: [GraalVM 25.0.3][graalvm_25].
• Upgrade: [Okio 3.17.0][okio_3_17_0].

v5.3.2

2025-11-18

• Fix: Don't delay triggering timeouts. In Okio 3.16.0 we introduced a regression that caused
  timeouts to fire later than they were supposed to.

• Upgrade: [Okio 3.16.4][okio_3_16_4].

v5.3.1

2025-11-16

This release is the same as 5.3.0. Okio 3.16.3 didn't have a necessary fix!

• Upgrade: [Okio 3.16.3][okio_3_16_3].

v5.3.0

2025-10-30

• New: Add tags to Call, including computable tags. Use this to attach application-specific
  metadata to a Call in an EventListener or Interceptor. The tag can be read in any other
  EventListener or Interceptor.

    override fun intercept(chain: Interceptor.Chain): Response {
      chain.call().tag(MyAnalyticsTag::class) {
        MyAnalyticsTag(...)
      }
  
      return chain.proceed(chain.request())
    }

• New: Support request bodies on HTTP/1.1 connection upgrades.

• New: EventListener.plus() makes it easier to observe events in multiple listeners.

• Fix: Don't spam logs with ‘Method isLoggable in android.util.Log not mocked.’ when using
  OkHttp in Robolectric and Paparazzi tests.

• Upgrade: [Kotlin 2.2.21][kotlin_2_2_21].

• Upgrade: [Okio 3.16.2][okio_3_16_2].

• Upgrade: [ZSTD-KMP 0.4.0][zstd_kmp_0_4_0]. This update fixes a bug that caused APKs to fail
  [16 KB ELF alignment checks][elf_alignment].

v5.2.3

2025-11-18

• Fix: Don't delay triggering timeouts. In Okio 3.16.0 we introduced a regression that caused
  timeouts to fire later than they were supposed to.

• Upgrade: [Okio 3.16.4][okio_3_16_4].

v5.2.2

2025-11-16

This release is the same as 5.2.1. Okio 3.16.3 didn't have a necessary fix!

• Upgrade: [Okio 3.16.3][okio_3_16_3].

v5.2.1

2025-10-09

• Fix: Don't crash when calling Socket.shutdownOutput() or shutdownInput() on an SSLSocket
  on Android API 21 through 23. This method throws an UnsupportedOperationException, so we now
  catch that and close the underlying stream instead.

• Upgrade: [Okio 3.16.1][okio_3_16_1].

v5.2.0

2025-10-07

• New: Support [HTTP 101] responses with Response.socket. This mechanism is only supported on
  HTTP/1.1. We also reimplemented our websocket client to use this new mechanism.

• New: The okhttp-zstd module negotiates [Zstandard (zstd)][zstd] compression with servers that
  support it. It integrates a new (unstable) [ZSTD-KMP] library, also from Square. Enable it like
  this:

  val client = OkHttpClient.Builder()
    .addInterceptor(CompressionInterceptor(Zstd, Gzip))
    .build()

• New: Support the QUERY HTTP method. You will need to set the Request.cacheUrlOverride
  property to cache calls made with this method. The RequestBody.sha256() may be helpful here;
  use it to compose a cache URL from the query body.

• New: Publish events when calls must wait to execute. EventListener.dispatcherQueueStart()
  is invoked when a call starts waiting, and dispatcherQueueEnd() is invoked when it's done.

• New: Request.toCurl() returns a copy-pasteable [curl] command consistent with Chrome’s and
  Firefox’s ‘copy as cURL’ features.

• New: Support [JPMS]. We replaced our Automatic-Module-Name metadata with proper
  module-info.java files.

• Fix: Recover gracefully when worker threads are interrupted. When we introduced fast fallback in
  OkHttp 5.0, we started using background threads while connecting. Sadly that code didn't handle
  interruptions well. This is now fixed.

• Upgrade: [Kotlin 2.2.20][kotlin_2_2_20].

• Upgrade: [Okio 3.16.0][okio_3_16_0].

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bito-code-review]

Review Skipped - Label Excluded

Bito didn't auto-review this change because the PR contains excluded label: renovate.
No action is needed if you didn't intend for the agent to review it. To trigger a review manually, type /review in a comment and save.

You can change this by removing the label from Filters → Exclude Labels setting here, or from the labels_excluded field in the .bito.yaml file (if repo-level configurations are enabled), or contact your workspace admin at michael.pearce@contentful.com.