Merge pull request #1215 from mendix/moo/MOO-2287-update-vulnerable-android-dependencies-master

[MOO-2287] - Update vulnerable okhttp, jackson, and security-crypto dependencies.

Author: YogendraShelke

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+- We updated vulnerable `okhttp`, `jackson`, and `security-crypto` dependencies.
+
+## [19.0.2] - 2026-04-22
+
 - We updated `mendix-native` to v0.4.1, strengthening Android cookie encryption by migrating from `AES/CBC/PKCS7Padding` to `AES/GCM/NoPadding`.
 
 ## [19.0.1] - 2026-04-22

android/app/build.gradle

@@ -124,14 +124,14 @@ dependencies {
     implementation project(':react-native-localize')
 
     // Explicit add okhttp
-    implementation("com.squareup.okhttp3:okhttp:4.9.1")
-    implementation("com.squareup.okhttp3:okhttp-urlconnection:4.9.1")
+    implementation("com.squareup.okhttp3:okhttp:${rootProject.ext.okhttpVersion}")
+    implementation("com.squareup.okhttp3:okhttp-urlconnection:${rootProject.ext.okhttpVersion}")
 
     // Required by MendixNative
-    implementation("com.fasterxml.jackson.core:jackson-core:2.11.3")
-    implementation("com.fasterxml.jackson.core:jackson-databind:2.11.3")
-    implementation("com.fasterxml.jackson.core:jackson-annotations:2.11.3")
-    implementation "androidx.security:security-crypto:1.1.0"
+    implementation("com.fasterxml.jackson.core:jackson-core:${rootProject.ext.jacksonVersion}")
+    implementation("com.fasterxml.jackson.core:jackson-databind:${rootProject.ext.jacksonVersion}")
+    implementation("com.fasterxml.jackson.core:jackson-annotations:${rootProject.ext.jacksonVersion}")
+    implementation "androidx.security:security-crypto:${rootProject.ext.securityCryptoVersion}"
 
     // Required for Custom Dev Apps
     devImplementation "androidx.constraintlayout:constraintlayout:2.0.4"

android/build.gradle

@@ -13,6 +13,10 @@ buildscript {
         androidXBrowser = "1.3.0"
 
         ndkVersion = "27.3.13750724"
+
+        jacksonVersion = "2.17.3"
+        okhttpVersion = "4.12.0"
+        securityCryptoVersion = "1.1.0"
     }
     repositories {
         google()