fix(deps): update okio to v3.18.1

[svc-secops]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
com.squareup.okio:okio-nodefilesystem	3.9.0 → 3.18.1
com.squareup.okio:okio	3.9.0 → 3.18.1

---

Release Notes

lysine-dev/okio (com.squareup.okio:okio-nodefilesystem)

v3.18.1

2026-07-28

• Fix: Restore binary-compatibility with Okio 3.17.x for Kotlin/Native users. When we introduced
  the new base64() function, we inadvertently changed the binary signature! Ugh! This is now
  fixed and we've automated binary-compatibility checking for Kotlin/Native going forward.

v3.18.0

2026-07-21

• Fix: Use wide character APIs to better support of non-UTF-8 filesystems on Windows.
• Fix: Don't crash in AssetFileSystem.exists() when the underlying storage throws a
  FileNotFoundException.
• Fix: Load WASI paths relative to their preopen. The platform behavior recently changed in
  NodeJS, causing our WasiFileSystem to be unable to access files!
• New: Optionally ignore whitespace when decoding hexadecimal.
• New: Optionally omit padding when encoding Base64.
• New: BufferedSource.readUInt(), BufferedSink.writeUInt(), and similar functions for UByte,
  UShort and ULong. Also add support for unsigned and little-endian.
• New: BufferedSink.utf8Appendable(). Use this to adapt an Okio sink to an Appendable.
• New: Source.limit() returns a wrapped source with a strict limit on how many bytes are
  returned.
• New: ByteString.equals(other, constantTime) for subtle defense against timing attacks.

v3.17.0

2026-03-11

• New: Adjust down the Kotlin stdlib dependency to [Kotlin 2.1.21][kotlin_2_1_21]. Okio is built
  with an up-to-date Kotlin compiler (2.2.21), but depends on an older kotlin-stdlib. We're doing
  this so you can update Okio and Kotlin independently.

• Fix: Return the correct timestamp in FileMetadata.createdAtMillis on Kotlin/Native on UNIX
  platforms. We were incorrectly using the POSIX ctime (change time) instead of the
  birthtime. With this fix Okio now prefers statx() over stat() on native platforms. This
  API first appeared in Linux in 4.11 (2017) and Android in API 30 (2020).

v3.16.4

2025-11-17

• Fix: Don't delay triggering timeouts. In 3.16.0 we introduced a regression that caused timeouts
  to fire later than they were supposed to.

v3.16.3

2025-11-14

This release is the same as 3.16.2. We forgot to cherry-pick a commit before we released!

v3.16.2

2025-10-14

• Fix: okio-assetfilesystem APIs now correctly restored as visible to Kotlin.

v3.16.1

2025-10-09

• Fix: Don't crash when calling Socket.shutdownOutput() or shutdownInput() on an SSLSocket on
  Android API 21. This method throws an UnsupportedOperationException, so we now catch that and
  close the underlying stream instead.

v3.16.0

2025-07-29

• Fix: Change Socket.asOkioSocket() to resolve its source InputStream and OutputStream
  eagerly. This will throw a SocketException immediately if the socket isn’t connected.
  This behavior is consistent with our similar APIs, Socket.source() and Socket.sink().

• Fix: Optimize AsyncTimeout on systems with a very large number of active timeouts. This class
  originally kept active timeouts in a linked list; with this update the internal data structure is
  a binary heap. The old runtime was 𝑂(𝑛²) to activate 𝑛 timeouts; with this optimization the
  runtime is 𝑂(𝑛 log 𝑛).

• Upgrade: [Kotlin 2.2.0][kotlin_2_2_0].

v3.15.0

2025-07-01

• Upgrade: [kotlinx-datetime 0.7.0-0.6.x-compat][datetime_0_7_0_compat]. The previous 3.14.0
  release, FakeFileSystem broke binary-compatibility for calls to FakeFileSystem(). This
  restores that compatibility.

• Breaking: Change FakeFileSystem.clock from a JVM field to a property. This avoids a crash
  running Okio in a Gradle 8.x plugin. This change is not binary-compatible.

v3.14.0

2025-06-28

• Upgrade: [kotlinx-datetime 0.7.0][datetime_0_7_0]. This impacts the okio-fakefilesystem
  artifact only. This is a binary-incompatible backwards-incompatible change that cannot co-exist
  with previous releases of okio-fakefilesystem! If you observe a NoSuchMethodError calling
  FakeFileSystem.init, update the calling code to this release (or newer) and recompile. We don't
  like imposing backwards-incompatible changes like this on you and do so regretfully.

v3.13.0

2025-06-13

• New: okio.Socket interface. This is a first step towards low-level streaming networking support
  for Kotlin/Multiplatform. This release provides two JVM-only implementations: asOkioSocket()
  adapts a java.net.Socket to our new interface, and inMemorySocketPair() returns a pair of
  mutually-connected sockets. We also anticipate that this interface will be a useful abstraction
  for proxies and tunnels.
• New: In-development snapshots are now published to the [Central Portal Snapshots repository].

v3.12.0

2025-05-27

• New: Support an optional end index when searching with BufferedSource.indexOf().
• Fix: Don't do unnecessary work in BufferedSource.rangeEquals().
• Upgrade: [Kotlin 2.1.21][kotlin_2_1_21].

v3.11.0

2025-04-09

• Fix: Clear the deflater's byte array reference
• New: Faster implementation of String.decodeHex() on Kotlin/JS.
• New: Declare EXACTLY_ONCE execution for blocks like Closeable.use {} and FileSystem.read {}.
• Upgrade: [Kotlin 2.1.20][kotlin_2_1_20].

v3.10.2

Compare Source

2025-01-08

• Fix: okio-nodefilesystem artifact is no longer empty.

v3.10.1

Compare Source

2025-01-07

• New: FileSystem.close() may prevent future access and/or clean up associated resources depending on the backing implementation. FakeFileSystem will prevent future operations once closed.
• InputStreams created from BufferedSource.inputStream() now have a more efficient version of InputStream.transferTo() which reduces memory copies.
• okio-nodefilesystem is no longer publised as a JS project, but a Kotlin multiplatform project with only a JS target. This change should not affect consumers in any way, and is motivated by the Kotlin Gradle plugin deprecating the JS-only plugin. Please use 3.10.2 to ensure this change actually does not affect your builds.

v3.10.0

Compare Source

2025-01-06

This version is equivalent to the subsequent 3.10.1, but it did not fully publish to Maven Central due to infrastructure problems.

v3.9.1

2024-09-12

• Fix: Support paths containing a single dot (".") in Path.relativeTo.
• Fix: Do not read from the upstream source when a 0-byte read is requested.
• Fix: Update kotlinx.datetime to 0.6.0 to correct a Gradle module metadata problem with 0.5.0.
  Note: this artifact is only used in 'okio-fakefilesystem' and 'okio-nodefilesystem' and not in the Okio core.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 8am and before 4pm on tuesday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

This PR has been generated by Renovate Bot.