[nwingt]

No description provided.

[notion-workspace]

在 Android app 強制 OkHttp 升級至 4.12.1 以封鎖被入侵的 eMudhra CA

[Copilot]

🔵 Needs a closer look

The change needs maintainer verification that OkHttp 4.12.1 exists and that the BOM platform constraint actually raises transitive okhttp versions, which must be confirmed via a dependency check after prebuild.

No open issues 🎉

What changed in this PR

This PR adds a local Expo config plugin that pins a minimum OkHttp version (4.12.1) on Android by injecting an OkHttp BOM platform() constraint into the generated android/app/build.gradle. The stated motivation is security: raising the OkHttp floor above the versions React Native (4.9.2) and other transitive dependencies (4.12.0) resolve to. It fits the repo's established "local config plugin in plugins/, registered in app.config.ts" pattern (mirroring withAppBoundDomains), keeping the native shell's Android build hardening surgical and declarative.

Changes:

• New plugins/withOkHttpVersion.js config plugin that uses mergeContents to insert implementation platform('com.squareup.okhttp3:okhttp-bom:4.12.1') just inside the app module's dependencies { } block, tagged for idempotent re-prebuilds.
• Registers ./plugins/withOkHttpVersion in the app.config.ts plugins array, after withAppBoundDomains and before the Intercom/notifications ordering-sensitive plugins.

File	Description
plugins/​withOkHttpVersion.js	New Android config plugin that injects an OkHttp BOM constraint into app/build.gradle to enforce a 4.12.1 version floor.
app.config.ts	Registers the new withOkHttpVersion plugin in the Expo plugin list.

Note: I was unable to verify from within this repo that okhttp-bom:4.12.1 is a published artifact or that the BOM constraint actually overrides the transitive OkHttp pins pulled in by React Native/Firebase — confirming both (e.g. via gradlew :app:dependencies after a prebuild) would be worthwhile before merge, since the security benefit depends on it.

_{Review effort: Balanced}