Prepare for release 5.5.0.

Author: swankjesse

CHANGELOG.md

@@ -1,6 +1,63 @@
 Change Log
 ==========
 
+## Version 5.5.0
+
+_2026-08-16_
+
+This release introduces **opt-in** support for [Encrypted Client Hello (ECH)]. This new feature
+improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s
+Wi-Fi router can see that you’re visiting _wikipedia.com_, but it cannot see which page you’re
+looking at. With ECH, the router observes only the IP address. This additional privacy is most
+effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.
+
+This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37,
+released June 2026). When other TLS stacks add ECH support, we'll integrate them.
+
+ECH took a lot of work to implement because the encryption keys are published over DNS in the
+[HTTPS resource record], and we needed to write new code to fetch these records. This release
+includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not
+just IP addresses!), asynchronous streaming results, and in-memory caching.
+
+To opt in, you can use `DnsOverHttps`:
+
+```kotlin
+// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
+// same bootstrap client so they share a connection pool and dispatcher.
+val bootstrapClient = OkHttpClient()
+
+// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
+val client = bootstrapClient.newBuilder()
+  .dns(DnsOverHttps.Builder()
+    .client(bootstrapClient)
+    .url("https://1.1.1.1/dns-query".toHttpUrl())
+    .build())
+  .build()
+```
+
+You could also opt in with our new `AndroidDns` API. Unfortunately, the privacy benefits of ECH are
+deficient because its DNS queries are not encrypted by default.
+
+```kotlin
+// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
+val client = OkHttpClient.Builder()
+  .dns(AndroidDns())
+  .build()
+```
+
+ *  New: OkHttp artifacts is now signed with our [new signing key]. This project and three sibling
+    projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
+ *  Fix: MockWebServer’s `@StartStop` annotation now supports `@Nested` JUnit 5 tests.
+ *  Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
+ *  Fix: Closing a multipart part's sink no longer closes the entire request body.
+ *  Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts
+    weren’t applied correctly.
+ *  Fix: Follow [RFC 1008]'s requirements for HTTP QUERY redirects.
+ *  Fix: Fall back to no proxy when the system proxy selector throws. Previously this would cause
+    the HTTP call to crash.
+ *  Upgrade: [Okio 3.18.1][okio_3_18_1].
+
+
 ## Version 5.4.0
 
 _2026-06-08_
@@ -769,12 +826,16 @@ release is the version name.
 
 See [4.x Change log](https://lysine.dev/okhttp/changelogs/changelog_4x/) for the legacy version changelogs.
 
+[Encrypted Client Hello (ECH)]: https://www.rfc-editor.org/info/rfc9849/
 [GraalVM]: https://www.graalvm.org/
 [Gradle module metadata]: https://docs.gradle.org/current/userguide/publishing_gradle_module_metadata.html
-[HTTP 101]: https://httpwg.org/specs/rfc9110.html#status.101
+[HTTP 101]: https://www.rfc-editor.org/info/rfc9110/#section-15.2.2
+[HTTPS resource record]: https://www.rfc-editor.org/info/rfc9460/
 [JPMS]: https://openjdk.org/projects/jigsaw/spec/
 [Ktor]: https://ktor.io/
+[Okio]: https://lysine.dev/okio/
 [Retrofit]: https://lysine.dev/retrofit/
+[SQLDelight]: https://sqldelight.github.io/sqldelight/
 [ZSTD-KMP]: https://github.com/square/zstd-kmp
 [androidx_startup]: https://developer.android.com/jetpack/androidx/releases/startup
 [annotation_1_9_1]: https://developer.android.com/jetpack/androidx/releases/annotation#annotation-1.9.1
@@ -800,6 +861,7 @@ See [4.x Change log](https://lysine.dev/okhttp/changelogs/changelog_4x/) for the
 [kotlin_2_2_20]: https://github.com/JetBrains/kotlin/releases/tag/v2.2.20
 [kotlin_2_2_21]: https://github.com/JetBrains/kotlin/releases/tag/v2.2.21
 [loom]: https://docs.oracle.com/en/java/javase/21/core/virtual-threads.html
+[new signing key]: https://keyserver.ubuntu.com/pks/lookup?search=5dd80b0ddccbe005f0a47fd66751e1a6e2001b8d&fingerprint=on&op=index
 [okio_2_9_0]: https://lysine.dev/okio/changelog/#version-290
 [okio_3_0_0]: https://lysine.dev/okio/changelog/#version-300
 [okio_3_12_0]: https://lysine.dev/okio/changelog/#version-3120
@@ -811,12 +873,15 @@ See [4.x Change log](https://lysine.dev/okhttp/changelogs/changelog_4x/) for the
 [okio_3_16_3]: https://lysine.dev/okio/changelog/#version-3163
 [okio_3_16_4]: https://lysine.dev/okio/changelog/#version-3164
 [okio_3_17_0]: https://lysine.dev/okio/changelog/#version-3170
+[okio_3_18_1]: https://lysine.dev/okio/changelog/#version-3181
 [okio_3_1_0]: https://lysine.dev/okio/changelog/#version-310
 [okio_3_2_0]: https://lysine.dev/okio/changelog/#version-320
 [okio_3_7_0]: https://lysine.dev/okio/changelog/#version-370
 [okio_3_9_0]: https://lysine.dev/okio/changelog/#version-390
-[rfc_8305]: https://tools.ietf.org/html/rfc8305
+[rfc_8305]: https://www.rfc-editor.org/info/rfc8305/
+[rfc_10008]: https://www.rfc-editor.org/info/rfc10008/
 [startup_1_2_0]: https://developer.android.com/jetpack/androidx/releases/startup#1.2.0
+[the Commonhaus Foundation]: https://www.commonhaus.org/activity/315.html
 [uts46]: https://www.unicode.org/reports/tr46
 [zstd]: https://github.com/facebook/zstd
 [zstd_kmp_0_4_0]: https://github.com/square/zstd-kmp/blob/main/CHANGELOG.md#version-040

README.md

@@ -123,10 +123,10 @@ Releases
 
 Our [change log][changelog] has release history.
 
-The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/okhttp/5.4.0/jar).
+The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/okhttp/5.5.0/jar).
 
 ```kotlin
-implementation("com.squareup.okhttp3:okhttp:5.4.0")
+implementation("com.squareup.okhttp3:okhttp:5.5.0")
 ```
 
 Snapshot builds are [available][snap]. [R8 and ProGuard][r8_proguard] rules are available.
@@ -136,7 +136,7 @@ Also, we have a [bill of materials (BOM)][bom] available to help you keep OkHttp
 ```kotlin
     dependencies {
        // define a BOM and its version
-       implementation(platform("com.squareup.okhttp3:okhttp-bom:5.4.0"))
+       implementation(platform("com.squareup.okhttp3:okhttp-bom:5.5.0"))
 
        // define any required OkHttp artifacts without version
        implementation("com.squareup.okhttp3:okhttp")
@@ -191,10 +191,10 @@ MockWebServer
 
 OkHttp includes a library for testing HTTP, HTTPS, and HTTP/2 clients.
 
-The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/mockwebserver/5.4.0/jar).
+The latest release is available on [Maven Central](https://search.maven.org/artifact/com.squareup.okhttp3/mockwebserver/5.5.0/jar).
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:mockwebserver3:5.4.0")
+testImplementation("com.squareup.okhttp3:mockwebserver3:5.5.0")
 ```
 
 MockWebServer is used for firstly for internal testing, and for basic testing of apps using OkHttp client.

build-logic/src/main/kotlin/okhttp.base-conventions.gradle.kts

@@ -7,7 +7,7 @@ import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
 val libs = extensions.getByType<VersionCatalogsExtension>().named("libs")
 
 group = "com.squareup.okhttp3"
-version = "5.5.0-SNAPSHOT"
+version = "5.5.0"
 
 val platform = project.platform
 val testJavaVersion = project.testJavaVersion

mockwebserver-junit4/README.md

@@ -6,7 +6,7 @@ This module integrates mockwebserver3.MockWebServer with JUnit 4.
 To use, first add this library as a test dependency:
 
 ```
-testImplementation("com.squareup.okhttp3:mockwebserver3-junit4:5.4.0")
+testImplementation("com.squareup.okhttp3:mockwebserver3-junit4:5.5.0")
 ```
 
 Then in tests annotated `@org.junit.Test`, you may declare a field with the `@Rule` annotation:

mockwebserver-junit5/README.md

@@ -6,7 +6,7 @@ This module integrates mockwebserver3.MockWebServer with JUnit 5.
 To use, first add this library as a test dependency:
 
 ```
-testImplementation("com.squareup.okhttp3:mockwebserver3-junit5:5.4.0")
+testImplementation("com.squareup.okhttp3:mockwebserver3-junit5:5.5.0")
 ```
 
 Annotate fields in test classes with `@StartStop`. The server will be started and shut down

mockwebserver/README.md

@@ -270,7 +270,7 @@ server.dispatcher = dispatcher
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:mockwebserver3:5.4.0")
+testImplementation("com.squareup.okhttp3:mockwebserver3:5.5.0")
 ```
 
 ### License

okhttp-brotli/README.md

@@ -14,7 +14,7 @@ OkHttpClient client = new OkHttpClient.Builder()
 ```
 
 ```kotlin
-implementation("com.squareup.okhttp3:okhttp-brotli:5.4.0")
+implementation("com.squareup.okhttp3:okhttp-brotli:5.5.0")
 ```
 
  [1]: https://github.com/google/brotli

okhttp-dnsoverhttps/README.md

@@ -6,7 +6,7 @@ This module is an implementation of [DNS over HTTPS][1] using OkHttp.
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:okhttp-dnsoverhttps:5.4.0")
+testImplementation("com.squareup.okhttp3:okhttp-dnsoverhttps:5.5.0")
 ```
 
 ### Usage

okhttp-java-net-cookiejar/README.md

@@ -7,5 +7,5 @@ This used to be part of `okhttp-urlconnection`
 ### Download
 
 ```kotlin
-testImplementation("com.squareup.okhttp3:okhttp-java-net-cookiejar:5.4.0")
+testImplementation("com.squareup.okhttp3:okhttp-java-net-cookiejar:5.5.0")
 ```

okhttp-logging-interceptor/README.md

@@ -37,7 +37,7 @@ Download
 --------
 
 ```kotlin
-implementation("com.squareup.okhttp3:logging-interceptor:5.4.0")
+implementation("com.squareup.okhttp3:logging-interceptor:5.5.0")
 ```