deps(gradle): bump vOkHttp from 4.12.0 to 5.4.0

[dependabot]

Bumps vOkHttp from 4.12.0 to 5.4.0.
Updates com.squareup.okhttp3:okhttp from 4.12.0 to 5.4.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.4.0

2026-06-08

• New: Add superpowers to interceptors. Interceptors can now override anything settable on OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with custom Call.Factory wrappers.
• Fix: Limit each HTTP/2 response to 256 KiB of total headers.
• Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional okhttp-coroutines artifact.
• Upgrade: [GraalVM 25.0.3][graalvm_25].
• Upgrade: [Okio 3.17.0][okio_3_17_0].

Version 5.3.2

2025-11-18

• Fix: Don't delay triggering timeouts. In Okio 3.16.0 we introduced a regression that caused timeouts to fire later than they were supposed to.

• Upgrade: [Okio 3.16.4][okio_3_16_4].

Version 5.3.1

2025-11-16

This release is the same as 5.3.0. Okio 3.16.3 didn't have a necessary fix!

• Upgrade: [Okio 3.16.3][okio_3_16_3].

Version 5.3.0

2025-10-30

• New: Add tags to Call, including computable tags. Use this to attach application-specific metadata to a Call in an EventListener or Interceptor. The tag can be read in any other EventListener or Interceptor.

    override fun intercept(chain: Interceptor.Chain): Response {
      chain.call().tag(MyAnalyticsTag::class) {
        MyAnalyticsTag(...)
      }
  return chain.proceed(chain.request())
  
  }

... (truncated)

Commits

• 61423f4 Prepare for release 5.4.0.
• d7e6eff Update eclipse.osgi to v3.24.200 (#9480)
• 7a35098 Update bnd to v7.3.0 (#9475)
• 0c5a45b Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (#9468)
• 113ad17 Update dependency macos to v26 (#9457)
• 84f601a Update shadow.plugin to v9.4.2 (#9466)
• 7d463f4 Update spotless.plugin to v8.6.0 (#9464)
• 3bf00f5 Update plugin com.diffplug.spotless to v8.6.0 (#9463)
• cfc45a3 Update spotless.plugin to v8.5.1 (#9456)
• 81c5006 Apply gradle lint correctly (#9459)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:logging-interceptor from 4.12.0 to 5.4.0

Changelog

Sourced from com.squareup.okhttp3:logging-interceptor's changelog.

Version 5.4.0

2026-06-08

• New: Add superpowers to interceptors. Interceptors can now override anything settable on OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with custom Call.Factory wrappers.
• Fix: Limit each HTTP/2 response to 256 KiB of total headers.
• Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional okhttp-coroutines artifact.
• Upgrade: [GraalVM 25.0.3][graalvm_25].
• Upgrade: [Okio 3.17.0][okio_3_17_0].

Version 5.3.2

2025-11-18

• Fix: Don't delay triggering timeouts. In Okio 3.16.0 we introduced a regression that caused timeouts to fire later than they were supposed to.

• Upgrade: [Okio 3.16.4][okio_3_16_4].

Version 5.3.1

2025-11-16

This release is the same as 5.3.0. Okio 3.16.3 didn't have a necessary fix!

• Upgrade: [Okio 3.16.3][okio_3_16_3].

Version 5.3.0

2025-10-30

• New: Add tags to Call, including computable tags. Use this to attach application-specific metadata to a Call in an EventListener or Interceptor. The tag can be read in any other EventListener or Interceptor.

    override fun intercept(chain: Interceptor.Chain): Response {
      chain.call().tag(MyAnalyticsTag::class) {
        MyAnalyticsTag(...)
      }
  return chain.proceed(chain.request())
  
  }

... (truncated)

Commits

• 61423f4 Prepare for release 5.4.0.
• d7e6eff Update eclipse.osgi to v3.24.200 (#9480)
• 7a35098 Update bnd to v7.3.0 (#9475)
• 0c5a45b Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (#9468)
• 113ad17 Update dependency macos to v26 (#9457)
• 84f601a Update shadow.plugin to v9.4.2 (#9466)
• 7d463f4 Update spotless.plugin to v8.6.0 (#9464)
• 3bf00f5 Update plugin com.diffplug.spotless to v8.6.0 (#9463)
• cfc45a3 Update spotless.plugin to v8.5.1 (#9456)
• 81c5006 Apply gradle lint correctly (#9459)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:okhttp-dnsoverhttps from 4.12.0 to 5.4.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-dnsoverhttps's changelog.

Version 5.4.0

2026-06-08

• New: Add superpowers to interceptors. Interceptors can now override anything settable on OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with custom Call.Factory wrappers.
• Fix: Limit each HTTP/2 response to 256 KiB of total headers.
• Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional okhttp-coroutines artifact.
• Upgrade: [GraalVM 25.0.3][graalvm_25].
• Upgrade: [Okio 3.17.0][okio_3_17_0].

Version 5.3.2

2025-11-18

• Fix: Don't delay triggering timeouts. In Okio 3.16.0 we introduced a regression that caused timeouts to fire later than they were supposed to.

• Upgrade: [Okio 3.16.4][okio_3_16_4].

Version 5.3.1

2025-11-16

This release is the same as 5.3.0. Okio 3.16.3 didn't have a necessary fix!

• Upgrade: [Okio 3.16.3][okio_3_16_3].

Version 5.3.0

2025-10-30

• New: Add tags to Call, including computable tags. Use this to attach application-specific metadata to a Call in an EventListener or Interceptor. The tag can be read in any other EventListener or Interceptor.

    override fun intercept(chain: Interceptor.Chain): Response {
      chain.call().tag(MyAnalyticsTag::class) {
        MyAnalyticsTag(...)
      }
  return chain.proceed(chain.request())
  
  }

... (truncated)

Commits

• 61423f4 Prepare for release 5.4.0.
• d7e6eff Update eclipse.osgi to v3.24.200 (#9480)
• 7a35098 Update bnd to v7.3.0 (#9475)
• 0c5a45b Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (#9468)
• 113ad17 Update dependency macos to v26 (#9457)
• 84f601a Update shadow.plugin to v9.4.2 (#9466)
• 7d463f4 Update spotless.plugin to v8.6.0 (#9464)
• 3bf00f5 Update plugin com.diffplug.spotless to v8.6.0 (#9463)
• cfc45a3 Update spotless.plugin to v8.5.1 (#9456)
• 81c5006 Apply gradle lint correctly (#9459)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[RobThePCGuy]

Held deliberately -- this is not an independent bump. Establishing it by building rather than guessing:

Dependency 'com.squareup.okhttp3:okhttp-android:5.4.0' requires libraries and applications
that depend on it to compile against version 36 or later of the Android APIs.
:app is currently compiled against android-34.
Also, the maximum recommended compile SDK version for AGP 8.5.1 is 34.

That chains OkHttp 5 -> compileSdk 36 -> AGP 9 -> Gradle 9, and Retrofit 3 requires OkHttp 5. The androidx group needs 35/36 as well (core-ktx 1.19.0, material 1.14.0).

So #25, #26, #29, #30 and #39 land together or not at all. Beyond the versions:

• Kyubi is compileSdk 34 / targetSdk 34 (buildSrc/Setup.kt:72), and only android-34 is installed on the build box -- SDK 36 is needed locally and in CI.
• Raising compileSdk drags targetSdk, which changes runtime behaviour for a root app on an emulator. That is a product decision needing its own VM validation, not a dependency merge.
• AGP 9 removed APIs buildSrc/Setup.kt relies on; compileSdkVersion(34) is already the deprecated form.

The other majors from this batch are done: jgit (#40) and libsu 6 (#41, VM-validated) both merged.