Bump okhttp from 4.9.1 to 4.9.3

[dependabot]

Bumps okhttp from 4.9.1 to 4.9.3.

Changelog

Sourced from okhttp's changelog.

Version 4.9.3

2021-11-21

• Fix: Don't fail HTTP/2 responses if they complete before a RST_STREAM is sent.

Version 4.9.2

2021-09-30

• Fix: Don't include potentially-sensitive header values in Headers.toString() or exceptions. This applies to Authorization, Cookie, Proxy-Authorization, and Set-Cookie headers.
• Fix: Don't crash with an InaccessibleObjectException when running on JDK17+ with strong encapsulation enabled.
• Fix: Strictly verify hostnames used with OkHttp's HostnameVerifier. Programs that make direct manual calls to HostnameVerifier could be defeated if the hostnames they pass in are not strictly ASCII. This issue is tracked as [CVE-2021-0341].

Version 5.0.0-alpha.2

2021-01-30

In this release MockWebServer has a new Maven coordinate and package name. A longstanding problem with MockWebServer has been its API dependency on JUnit 4. We've reorganized things to remove that dependency while preserving backwards compatibility.

Maven Coordinate	Package Name	Description
com.squareup.okhttp3:mockwebserver3:5.0.0-alpha.2	mockwebserver3	Core module. No JUnit dependency!
com.squareup.okhttp3:mockwebserver3-junit4:5.0.0-alpha.2	mockwebserver3.junit4	Optional JUnit 4 integration.
com.squareup.okhttp3:mockwebserver3-junit5:5.0.0-alpha.2	mockwebserver3.junit5	Optional JUnit 5 integration.
com.squareup.okhttp3:mockwebserver:5.0.0-alpha.2	okhttp3.mockwebserver	Obsolete. Depends on JUnit 4.

The new APIs use mockwebserver3 in both the Maven coordinate and package name. This new API is not stable and will likely change before the final 5.0.0 release.

If you have code that subclasses okhttp3.mockwebserver.QueueDispatcher, this update is not source or binary compatible. Migrating to the new mockwebserver3 package will fix this problem.

• New: DNS over HTTPS is now a stable feature of OkHttp. We introduced this as an experimental module in 2018. We are confident in its stable API and solid implementation.
• Fix: Work around a crash in Android 10 and 11 that may be triggered when two threads concurrently close an SSL socket. This would have appeared in crash logs as NullPointerException: bio == null.
• Fix: Use plus + instead of %20 to encode space characters in FormBody. This was a longstanding bug in OkHttp. The fix makes OkHttp consistent with major web browsers.
• Fix: Don't crash if Conscrypt returns a null version.
• Fix: Include the public suffix data as a resource in GraalVM native images.

... (truncated)

Commits

• 0a27e9f Prepare for release 4.9.3.
• 97a8f6c Confirm we can read a response that completed before RST_STREAM (#6293) (#6914)
• b1a39f4 Prepare next development version.
• 3edf17c Prepare for release 4.9.2.
• 262b3cd Handle strict module handling on JDK17 (#6707) (#6742)
• f574ea2 Cherry pick fix for CVE-2021-0341 onto 4.9.x (#6741)
• 1fd7c0a Make it more difficult to accidentally log sensitive headers (#6551) (#6740)
• b0397cc 4.9.x GitHub builds update (#6732)
• eb5a834 Prepare next development version.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #101.