Upgrading com.squareup.okhttp3:okhttp 4 to 5
Breaking4.12.1 → 5.5.1Breaking29Security2Platform1New53Changed44Fixed69Other1
SecurityBlocks 8 compromised eMudhra intermediate certificates, protecting JVMs and AOSP devices exposed to them.Advisory ↗
BreakingUpgrade verdict
29 breaking changes and a platform requirement change and 2 security fixes.
In plain terms
- Removes AddressPolicy, AsyncDns, and ConnectionListener from the public API.
- Renames RecordedRequest.sequenceNumber to exchangeIndex and adds connectionIndex.
- Renames RecordedRequest.path to RecordedRequest.target.
- The separate okhttp-android library is gone; its pieces moved into the main okhttp library.
Must act Top 5 of 32 that need code or config changes
Adds org.jetbrains.kotlin:kotlin-stdlib 2.1.21.
Drops org.jetbrains.kotlin:kotlin-stdlib-jdk8.
Installs 4 packages in all (was 7).
What you must change
Breaking29
Removes AddressPolicy, AsyncDns, and ConnectionListener from the public API.
AddressPolicyAsyncDnsConnectionListenerRenames RecordedRequest.sequenceNumber to exchangeIndex and adds connectionIndex.
RecordedRequest.sequenceNumberRecordedRequest.exchangeIndexRecordedRequest.connectionIndexRenames RecordedRequest.path to RecordedRequest.target.
RecordedRequest.pathRecordedRequest.targetRemoves the okhttp-android artifact introduced in 5.0.0-alpha.7.
Removes the AndroidLogging class; LoggingEventListener and HttpLoggingInterceptor now write to logcat by default.
AndroidLoggingLoggingEventListenerHttpLoggingInterceptorDrops support for Kotlin Multiplatform.
Uses kotlin.time.Duration in APIs like OkHttpClient.Builder.callTimeout() and drops the DurationUnit functions from earlier alphas.
kotlin.time.DurationOkHttpClient.Builder.callTimeout()DurationUnitRemoves the tunnelProxy argument from MockWebServer.useHttps() in the mockwebserver3 package.
MockWebServer.useHttps()tunnelProxymockwebserver3Removes Cloneable from OkHttpClient.
OkHttpClientCloneableMockWebServer moves to new mockwebserver3 Maven coordinates and package names, removing the JUnit 4 dependency from the core module.
mockwebserver3mockwebserver3.junit4mockwebserver3.junit5okhttp3.mockwebserverCode that subclasses okhttp3.mockwebserver.QueueDispatcher is no longer source or binary compatible; migrate to the mockwebserver3 package.
okhttp3.mockwebserver.QueueDispatcherOkHttp is now packaged as separate JVM and Android artifacts, enabling platform-specific features and optimizations.
MockWebServer moves to new coordinates and package names, with the old okhttp3.mockwebserver artifact still published.
mockwebserver3mockwebserver3.junit4mockwebserver3.junit5okhttp3.mockwebserverMoves gzip from RequestBody to Request.Builder, handling body compression and Content-Encoding.
RequestBodyRequest.BuildergzipContent-EncodingMakes RecordedRequest.body nullable, with null meaning the request has no body.
RecordedRequest.bodyMakes RecordedRequest.chunkSizes nullable, with null meaning the request is not chunked.
RecordedRequest.chunkSizesReplaces SocketPolicy with SocketEffect, splitting triggers from effects.
SocketPolicySocketEffectReplaces the parameters-based JUnit 5 extension with a @StartStop annotation on a MockWebServer property.
@StartStopMockWebServerStops auto-starting MockWebServer on accessor calls like port; accessors now throw IllegalStateException if not started.
MockWebServerportIllegalStateExceptionDecomposes RecordedRequest.requestLine into method, target, and version properties.
RecordedRequest.requestLineRecordedRequest.methodRecordedRequest.targetRecordedRequest.versionChanges RecordedRequest.body from a mutable Buffer to an immutable ByteString.
RecordedRequest.bodyBufferByteStringAdopts Okio's new Socket interface for MockResponse.socketHandler.
SocketMockResponse.socketHandlerMoves the AndroidAsyncDns class from okhttp-android to the okhttp artifact.
AndroidAsyncDnsMoves coroutines extensions to the okhttp3.coroutines package for Java Platform Module System compatibility.
okhttp3.coroutinesTags unstable new APIs as @ExperimentalOkHttpApi, with OkHttp 5.0 planned to ship without stabilizing them.
@ExperimentalOkHttpApiReorders the parameters in the Cache constructor introduced in 5.0.0-alpha.3.
CacheMakes mockwebserver3.SocketPolicy a sealed interface, a backwards-incompatible change for early adopters.
mockwebserver3.SocketPolicyMakes mockwebserver3.MockResponse immutable, requiring a Builder.
mockwebserver3.MockResponseBuilderMakes Response.body non-null; reading content fails for cacheResponse, networkResponse, and priorResponse bodies.
Response.bodyResponse.cacheResponseResponse.networkResponseResponse.priorResponseSecurity2
Blocks 8 compromised eMudhra intermediate certificates, protecting JVMs and AOSP devices exposed to them.
Stops logging sensitive headers in Request.toString().
Request.toString()Platform1
ECH requires platform TLS stack support, currently only Android 17 (API 37, released June 2026).