build: bump com.squareup.okhttp3:okhttp in /openai-java-bedrock

[dependabot]

Bumps com.squareup.okhttp3:okhttp in /openai-java-bedrock from 4.12.0 to 5.5.0.

Updates com.squareup.okhttp3:okhttp from 4.12.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:okhttp from 4.12.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T09:23:12.683287Z	f37150c	PR opened
🔒 Security Review	✅ Completed 2026-10-19T09:21:17.472820Z	f37150c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 236/236 SDK tests passed in 15.95s for Java SDK PR #1227.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	591ms
tests/chat-completions-create.test.ts	✅ Passed	379ms
tests/chat-completions-stream.test.ts	✅ Passed	652ms
tests/files-content-binary.test.ts	✅ Passed	291ms
tests/files-create-multipart.test.ts	✅ Passed	402ms
tests/files-list-pagination.test.ts	✅ Passed	237ms
tests/initialize-config.test.ts	✅ Passed	221ms
tests/instance-isolation.test.ts	✅ Passed	216ms
tests/models-list.test.ts	✅ Passed	353ms
tests/responses-background-lifecycle.test.ts	✅ Passed	264ms
tests/responses-body-method-errors.test.ts	✅ Passed	547ms
tests/responses-cancel-timeout.test.ts	✅ Passed	243ms
tests/responses-cancel.test.ts	✅ Passed	296ms
tests/responses-compact-retries.test.ts	✅ Passed	446ms
tests/responses-compact.test.ts	✅ Passed	350ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	445ms
tests/responses-create-advanced.test.ts	✅ Passed	1.549s
tests/responses-create-disconnect.test.ts	✅ Passed	1.199s
tests/responses-create-errors.test.ts	✅ Passed	357ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	265ms
tests/responses-create-retries.test.ts	✅ Passed	381ms
tests/responses-create-stream-failures.test.ts	✅ Passed	1.812s
tests/responses-create-stream-timeout.test.ts	✅ Passed	223ms
tests/responses-create-stream-wire.test.ts	✅ Passed	5.143s
tests/responses-create-stream.test.ts	✅ Passed	162ms
tests/responses-create-terminal-states.test.ts	✅ Passed	505ms
tests/responses-create-timeout.test.ts	✅ Passed	241ms
tests/responses-create.test.ts	✅ Passed	302ms
tests/responses-delete.test.ts	✅ Passed	310ms
tests/responses-input-items-errors.test.ts	✅ Passed	308ms
tests/responses-input-items-list.test.ts	✅ Passed	342ms
tests/responses-input-items-options.test.ts	✅ Passed	314ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	260ms
tests/responses-input-tokens-count.test.ts	✅ Passed	324ms
tests/responses-malformed-inputs.test.ts	✅ Passed	4.017s
tests/responses-not-found-errors.test.ts	✅ Passed	479ms
tests/responses-parse.test.ts	✅ Passed	609ms
tests/responses-retrieve-retries.test.ts	✅ Passed	289ms
tests/responses-retrieve.test.ts	✅ Passed	278ms
tests/responses-stored-method-errors.test.ts	✅ Passed	980ms
tests/retry-behavior.test.ts	✅ Passed	3.738s
tests/sdk-error-shape.test.ts	✅ Passed	461ms

View OkTest run #39229057472

_{SDK merge (d3603b0633b7) · head (f37150ceb1e3) · base (f886d7a12fee) · OkTest (ebbcfaca8a5e)}

[github-actions]

Castiron custom code

Evaluated main: f886d7a12fee9c3cedce9084dd692b9933a8f7ab.

Trusted main policy: f886d7a12fee9c3cedce9084dd692b9933a8f7ab.

✅ No new custom-code files detected.

99 mixed files remain; 0 existing customizations changed.

Compared f886d7a12fee → f37150ceb1e3. Generated baselines verified.

99 existing customizations unchanged

• openai-java-core/src/main/kotlin/com/openai/client/OpenAIClientAsyncImpl.kt
• openai-java-core/src/main/kotlin/com/openai/client/OpenAIClientImpl.kt
• openai-java-core/src/main/kotlin/com/openai/models/admin/organization/projects/apikeys/ApiKeyUpdateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/audio/AudioResponseFormat.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/environments/EnvironmentCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/vaults/credentials/CredentialAuth.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/vaults/credentials/CredentialAuthCreateParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/agents/vaults/credentials/CredentialAuthRotateParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponse.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponseError.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponseInjectEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponseInjectFailedEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponseStreamEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponseToolSearchOutputItemParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/beta/responses/BetaResponsesServerEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionMessageFunctionToolCall.kt
• openai-java-core/src/main/kotlin/com/openai/models/chat/completions/ChatCompletionToolMessageParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/conversations/ConversationCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/conversations/items/ItemCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/embeddings/Embedding.kt
• openai-java-core/src/main/kotlin/com/openai/models/embeddings/EmbeddingCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/live/ResponseItemCreateEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/realtime/RealtimeResponseStatus.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/Response.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseCreateParams.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseError.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionToolCall.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseFunctionWebSearch.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseInputItem.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseStreamEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseTextConfig.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponseToolSearchOutputItemParam.kt
• openai-java-core/src/main/kotlin/com/openai/models/responses/ResponsesServerEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/vectorstores/filebatches/VectorStoreFileBatch.kt
• openai-java-core/src/main/kotlin/com/openai/models/videos/Video.kt
• openai-java-core/src/main/kotlin/com/openai/models/videos/VideoCreateError.kt
• openai-java-core/src/main/kotlin/com/openai/models/webhooks/UnwrapWebhookEvent.kt
• openai-java-core/src/main/kotlin/com/openai/models/webhooks/WebhookEndpointWithSecret.kt
• openai-java-core/src/main/kotlin/com/openai/services/async/BetaServiceAsync.kt

59 more in the full report.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 39229112772 --repo openai/openai-java \
  --name castiron-custom-code-39229112772-1 --dir /tmp/castiron-custom-code-39229112772-1
git apply --stat /tmp/castiron-custom-code-39229112772-1/custom-code.patch
cat /tmp/castiron-custom-code-39229112772-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin f886d7a12fee9c3cedce9084dd692b9933a8f7ab f37150ceb1e3406bd96a9861546117f26b2a8750
python3 scripts/castiron/custom_code_report.py report \
  --base f886d7a12fee9c3cedce9084dd692b9933a8f7ab \
  --head f37150ceb1e3406bd96a9861546117f26b2a8750 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-f37150ceb1e3
cat /tmp/castiron-custom-code-f37150ceb1e3/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f37150ceb1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Depend on the JVM artifact for Maven consumers

OkHttp 5 publishes com.squareup.okhttp3:okhttp as a multiplatform metadata artifact: Gradle follows its module metadata to okhttp-jvm, but Maven receives an effectively empty JAR whose POM does not redirect to the JVM artifact. Because this declared coordinate is retained in the SDK's generated POM, Maven users of openai-java-client-okhttp (and transitively openai-java-bedrock) will get NoClassDefFoundError for okhttp3 classes when building the client. Use com.squareup.okhttp3:okhttp-jvm:5.5.0 for the published JVM modules, or explicitly rewrite the published POM and cover Maven consumption.

AGENTS.md reference: AGENTS.md:L34-L36

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add the required OkHttp 5 migration ADR

This changes the transport from the OkHttp 4 dependency generation to OkHttp 5, but the commit contains only coordinate updates and a repo-wide search under docs/ finds no corresponding decision record. docs/version-support-policy.md:60-62 requires every material dependency-generation change to have an ADR covering lifecycle evidence, affected artifacts, consumer resolution, migration, SemVer treatment, the final compatible release, and verification; add that ADR before landing this major-generation upgrade.

Useful? React with 👍 / 👎.