SYN-648: Bump org.json and okhttp to clear High alerts

[vmangwani]

What problem are you trying to solve?

• lob-java has 3 open High Dependabot alerts on pom.xml: com.squareup.okhttp3:okhttp (Update lob-java-1.1.jar into github #8) and org.json:json (Fix tracking variable mapping in Job object. #6, Add tests #4). Ticket: SYN-648 (parent SYN-624).

How did you solve this problem?

• org.json:json 20220320 -> 20231013 (pom.xml:454).
• <okhttp-version> 4.9.1 -> 4.9.2 (pom.xml:476). logging-interceptor shares the property and moves with it.
• CI fix (operator-approved): .github/workflows/run_tests.yml:27 actions/cache@v2 -> @v4. GitHub auto-fails jobs that use cache@v2, so run_tests never started on this PR (Dependabot chore(deps): bump com.squareup.okhttp3:okhttp from 4.9.1 to 4.9.2 #351 fails the same way).
• No source changes were needed. ApiClient.java only uses org.json/okhttp APIs that didn't change across these versions.

Important notes

• Supersedes Dependabot PRs chore(deps): bump com.squareup.okhttp3:okhttp from 4.9.1 to 4.9.2 #351 (okhttp) and chore(deps): bump org.json:json from 20220320 to 20231013 #338 (org.json). Close them after this merges.
• ApiClient.java:803-806 and :1041-1043 (org.json use) aren't unit-covered. Only the live *SpecTest CI run exercises them, so check that this PR's CI is green before merging.
• The build was proven with mvn clean compile, not install -DskipTests. The maven-gpg-plugin is bound unconditionally at verify (pom.xml:223-238) and fails without a signing key. That failure predates this change.
• Sibling PR: lob/lob-php SYN-648: Bump guzzle, phpunit and symfony/process to clear High alerts lob-php#193 (same ticket, independent; either can merge first).

CI status

• With the cache fix, run_tests runs: 1189 tests, 11 failures, all in the live Integration.*SpecTest suite, 39 skipped (run 36204693707). Every Api/Model unit test passes.
• The 11 failures come from the CI Lob account and keys, not this change: "This endpoint requires live mode, but test mode was used" (Campaigns, Creatives, Uploads), "Print & Mail Edition does not allow you to add more Scheduled Mailings" (Letters), "Your API key is not valid" message mismatch (IdentityValidation), "check not found" (Check), and a self-mailer render trigger failure. These failures were already there before this PR; main's CI hasn't run since cache@v2 started being auto-failed.

Test plan

Run in Docker (maven:3-eclipse-temurin-17; CI uses JDK 14):

1. mvn -B dependency:tree -Dincludes=org.json:json,com.squareup.okhttp3 shows okhttp 4.9.2, logging-interceptor 4.9.2 and json 20231013.
2. mvn -B clean compile: BUILD SUCCESS.
3. mvn -B test "-Dtest=%regex[.*ApiTest.*]": base 156 tests, 0 failures; after 156, 0 failures.
4. mvn -B test "-Dtest=%regex[.*Model.*]": base 956 tests, 0 failures; after 956, 0 failures.
5. The live *SpecTest suite (needs repo secrets) runs in PR CI.

Review: 1 round. The lob-java specialist and the tech lead both approved, with no findings on this repo.

Acceptance criteria

AC	Status	Evidence
1. lob-php: guzzlehttp/guzzle resolves to >= 7.15.2 in composer.lock and the composer.json constr	✅	✅ unit: lob-php test/Unit/*ApiUnitTest.php (full @group unit suite, run via vendor/bin/phpunit --group unit --coverage-text --configuration=phpunit.xml.dist) plus composer install/show (gates green)
2. lob-php: phpunit/phpunit resolves to >= 9.6.33 and symfony/process to >= 5.4.46 in `composer.loc	✅	✅ unit: lob-php test/Unit/*ApiUnitTest.php (full @group unit suite, run via vendor/bin/phpunit --group unit --coverage-text --configuration=phpunit.xml.dist) (gates green)
3. lob-java: org.json:json resolves to >= 20231013 and com.squareup.okhttp3:okhttp to >= 4.9.2 in t	✅	✅ integration: lob-java mvn dependency:tree -Dincludes=org.json:json,com.squareup.okhttp3 (build/resolution check, not a JUnit/TestNG test; confirms org.json:json:20231013 and okhttp:4.9.2 in the effective tree) plus mvn clean compile (gates green)
4. lob-java: the existing unit test suite passes after the bumps. Any API changes from the okhttp or or	✅	✅ unit: lob-java tests/Api/*ApiTest.java (full suite, run via mvn test "-Dtest=%regex[.ApiTest.]") and tests/Model/*Test.java (full suite, run via mvn test "-Dtest=%regex[.Model.]") (gates green)
5. Before and after High counts are recorded on the ticket per repo. Before: lob-php 3 (live Dependabot	⏳	⏳ manual-operator: pending AC5-manual-operator

Pending checks (the PR stays draft until these pass)

• AC5-manual-operator AC5 · manual-operator · owner: operator

Risks (every review round)

• lob-php: --with-all-dependencies pulled transitive major bumps into composer.lock: guzzlehttp/promises 1.5.1 -> 2.5.3, psr/http-message 1.0.1 -> 2.0 (runtime), nikic/php-parser v4 -> v5 and doctrine/instantiator 1 -> 2 (dev). phpspec/prophecy, phpdocumentor/* and webmozart/assert were dropped. lib/ doesn't implement any PSR-7 interface and doesn't call removed promise functions. Only Psr7\Utils::tryFopen is used. composer.json ranges are unchanged, so SDK consumers resolve their own versions. (r1)
• lob-php: guzzle resolves to 7.15.5, phpunit to 9.6.37 and symfony/process to v5.4.51, all above the minimums. The regenerated lock makes lob-php#171 (psr7 2.4.5, Medium) redundant: psr7 is now 2.13.1. (r1)
• lob-php: the lock's dev set is effectively PHP >= 8.1 (doctrine/instantiator 2.0 requires ^8.1, and symfony/deprecation-contracts v3 already required >= 8.1 before this change). composer.json still says ^7.3 || ^8.1. (r1)
• lob-php: the run_tests.yml:20 typo fix means CI runs the unit suite for the first time: 357 tests pass on PHP 8.1 (implementer) and on PHP 8.3 (tech-lead, php:8.3-cli, matching ubuntu-latest). (r1)
• lob-java: org.json jumps 20220320 -> 20231013. ApiClient.java:803-806 (CreativeResponse: JSONObject.put of a bean, then toString) and :1041-1043 (error parsing) aren't unit-covered, so only the live *SpecTest CI run exercises them. Check that the PR CI run is green before merge. (r1)
• lob-java follow-up: build.gradle:109-110 and build.sbt:13-14 still pin okhttp 4.9.1 (not read by Dependabot or CI). (r1)
• lob-java: the build was proven with mvn clean compile, not install -DskipTests, because the maven-gpg-plugin is bound at verify (pom.xml:223-238) and needs a signing key. This predates the change. (r1)
• AC5 is operator-only: after merge, confirm 0 open High alerts per repo and post the before/after table. Close lob-java#351 and chore(deps): bump org.json:json from 20220320 to 20231013 #338, and post the SUP-1322 note. (r1)

Follow-ups

• The operator accepted the 11 live *SpecTest failures for this PR. Follow-up: fix the CI Lob account and keys used by the live SpecTests. That means live-mode access for Campaigns, Creatives and Uploads, the scheduled-mailing plan limit, the IdentityValidation API-key message, the Check fixture, and the self-mailer render.
• Follow-up: add synchronize to run_tests.yml's pull_request types (in lob-java and lob-php), so pushes to an open PR run CI.
• build.gradle:109-110 and build.sbt:13-14 still pin okhttp 4.9.1. Neither Dependabot nor CI reads them; left unchanged on purpose.
• After merge: confirm 0 open High alerts on lob-java and record the after-count on SYN-648 (AC5). Close chore(deps): bump com.squareup.okhttp3:okhttp from 4.9.1 to 4.9.2 #351 and chore(deps): bump org.json:json from 20220320 to 20231013 #338.

🤖 Generated with Claude Code