We are in the process of upgrading from Spark 3.3.1 to Spark 3.5.0. However, we are seeing some security alerts with okhttp3 version (3.12.12) that is bundled with Spark 3.5. In order to fix this, I did the following:
okhttp-3.12.12.jar → okhttp-4.12.0.jar
okio-1.15.0.jar → okio-3.7.0.jar
And I also added kotlin-stdlib-1.9.22.jar since this is needed by the latest version of okhttp3.
However, I am getting ClassNotFoundException for okio.Buffer from okhttp3.
I do see okio/Buffer in version 1.15 of okio but not in version 3.7.
Can someone guide me here as to what JAR files should be included in order to move to the latest version of okhttp3 (needed for getting rid of the CVE alerts)?
Many thanks.
I’m not sure myself, but I’ll ask around and see!