From 307c8187e84e45977c5b2003b6c6956d56abc3c1 Mon Sep 17 00:00:00 2001
From: Yogendra Shelke <25844542+YogendraShelke@users.noreply.github.com>
Date: Thu, 23 Apr 2026 16:19:17 +0530
Subject: [PATCH] chore: update vulnerable okhttp, jackson, and security-crypto
 dependencies

---
 CHANGELOG.md             |  4 ++++
 android/app/build.gradle | 12 ++++++------
 android/build.gradle     |  4 ++++
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 633a750c..877c9ff6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+- We updated vulnerable `okhttp`, `jackson`, and `security-crypto` dependencies.
+
+## [19.0.2] - 2026-04-22
+
 - We updated `mendix-native` to v0.4.1, strengthening Android cookie encryption by migrating from `AES/CBC/PKCS7Padding` to `AES/GCM/NoPadding`.
 
 ## [19.0.1] - 2026-04-22
diff --git a/android/app/build.gradle b/android/app/build.gradle
index 646ef152..5ec599dc 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -124,14 +124,14 @@ dependencies {
     implementation project(':react-native-localize')
 
     // Explicit add okhttp
-    implementation("com.squareup.okhttp3:okhttp:4.9.1")
-    implementation("com.squareup.okhttp3:okhttp-urlconnection:4.9.1")
+    implementation("com.squareup.okhttp3:okhttp:${rootProject.ext.okhttpVersion}")
+    implementation("com.squareup.okhttp3:okhttp-urlconnection:${rootProject.ext.okhttpVersion}")
 
     // Required by MendixNative
-    implementation("com.fasterxml.jackson.core:jackson-core:2.11.3")
-    implementation("com.fasterxml.jackson.core:jackson-databind:2.11.3")
-    implementation("com.fasterxml.jackson.core:jackson-annotations:2.11.3")
-    implementation "androidx.security:security-crypto:1.1.0"
+    implementation("com.fasterxml.jackson.core:jackson-core:${rootProject.ext.jacksonVersion}")
+    implementation("com.fasterxml.jackson.core:jackson-databind:${rootProject.ext.jacksonVersion}")
+    implementation("com.fasterxml.jackson.core:jackson-annotations:${rootProject.ext.jacksonVersion}")
+    implementation "androidx.security:security-crypto:${rootProject.ext.securityCryptoVersion}"
 
     // Required for Custom Dev Apps
     devImplementation "androidx.constraintlayout:constraintlayout:2.0.4"
diff --git a/android/build.gradle b/android/build.gradle
index 5823a224..d528f750 100644
--- a/android/build.gradle
+++ b/android/build.gradle
@@ -13,6 +13,10 @@ buildscript {
         androidXBrowser = "1.3.0"
 
         ndkVersion = "27.3.13750724"
+
+        jacksonVersion = "2.17.3"
+        okhttpVersion = "4.12.0"
+        securityCryptoVersion = "1.1.0"
     }
     repositories {
         google()