From b1aab87b160f4524547bf92bc6d68731044c8ed8 Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Mon, 15 Jul 2024 16:40:14 +0200
Subject: [PATCH 1/3] Upgrade to okio 1.17.6 to get rid of CVE

---
 pom.xml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index f912210..91bc901 100644
--- a/pom.xml
+++ b/pom.xml
@@ -49,6 +49,8 @@
     <maven-site-plugin.version>3.12.1</maven-site-plugin.version>
     <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>
     <spotless-maven-plugin.version>2.43.0</spotless-maven-plugin.version>
+    <kubernetes-client.version>6.13.1</kubernetes-client.version>
+    <okio.version>1.17.6</okio.version>
   </properties>
 
   <dependencies>
@@ -85,12 +87,23 @@
     <dependency>
       <groupId>io.fabric8</groupId>
       <artifactId>kubernetes-client</artifactId>
-      <version>6.13.1</version>
+      <version>${kubernetes-client.version}</version>
     </dependency>
     <dependency>
       <groupId>io.fabric8</groupId>
       <artifactId>kubernetes-client-api</artifactId>
-      <version>6.13.1</version>
+      <version>${kubernetes-client.version}</version>
+    </dependency>
+    <dependency>
+      <!--
+      We bump this here to get rid of a critical CVE in okio 1.15 which we get via kubernetes-client.
+      We tried understanding _why_ we get 1.15 as dependency:tree for kubernetes-client says we should be getting 1.17.6.
+      As we failed to understand this we did this short/medium term fix of adding an explicit dependency here which should override the one coming from kubernetes-client.
+      This can be removed again as soon as we get the proper version from kubernetes-client.
+      -->
+      <groupId>com.squareup.okio</groupId>
+      <artifactId>okio</artifactId>
+      <version>${okio.version}</version>
     </dependency>
     <!-- End of needed by topology-provider -->
     <dependency>

From 290d8d529136e93a23c932d03a4f8217a8150712 Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Mon, 15 Jul 2024 16:42:21 +0200
Subject: [PATCH 2/3] Update changelog

---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2319299..21b6712 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Changed
+
+- Bump okio to 1.17.6 to get rid of CVE-2023-3635 ([#46])
+
+[#46]: https://github.com/stackabletech/hdfs-utils/pull/46 
+
 ## [0.3.0] - 2024-07-04
 
 ### Added

From 4f79ff1691e2e951dc9820dbd97b619c97814a29 Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Fri, 19 Jul 2024 10:15:16 +0200
Subject: [PATCH 3/3] Fix markdownlint

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21b6712..441e97d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ All notable changes to this project will be documented in this file.
 
 - Bump okio to 1.17.6 to get rid of CVE-2023-3635 ([#46])
 
-[#46]: https://github.com/stackabletech/hdfs-utils/pull/46 
+[#46]: https://github.com/stackabletech/hdfs-utils/pull/46
 
 ## [0.3.0] - 2024-07-04