Assertions.assertTrue(pin.matchesCertificate(certA1.certificate))
    Assertions.assertFalse(pin.matchesCertificate(certB1.certificate))
  }

  @Test
  fun testMatchesSha1() {
    val pin = CertificatePinner.Pin("example.com", certC1Sha1Pin)
    Assertions.assertTrue(pin.matchesCertificate(certC1.certificate))
    Assertions.assertFalse(pin.matchesCertificate(certB1.certificate))

## Pin your `fastapi` version

The first thing you should do is to "pin" the version of **FastAPI** you are using to the specific latest version that you know works correctly for your application.

For example, let's say you are using version `0.112.0` in your app.

      for (Certificate certificate : chain.connection().handshake().peerCertificates()) {
        String pin = CertificatePinner.pin(certificate);
        if (denylist.contains(pin)) {
          throw new IOException("Denylisted peer certificate: " + pin);
        }
      }
      return chain.proceed(chain.request());
    }
  };

  private final OkHttpClient client = new OkHttpClient.Builder()

    assertFalse(pin.matchesHostname("www.example.com"))
  }

  @Test fun testMatchesSha256() {
    val pin = Pin("example.com", certA1Sha256Pin)
    assertTrue(pin.matchesCertificate(certA1.certificate))
    assertFalse(pin.matchesCertificate(certB1.certificate))
  }

  @Test fun testMatchesSha1() {
    val pin = Pin("example.com", certC1Sha1Pin)
    assertTrue(pin.matchesCertificate(certC1.certificate))

      when {
        pin.startsWith("sha1/") -> {
          this.hashAlgorithm = "sha1"
          this.hash = pin.substring("sha1/".length).decodeBase64() ?: throw IllegalArgumentException("Invalid pin hash: $pin")
        }
        pin.startsWith("sha256/") -> {
          this.hashAlgorithm = "sha256"

import kotlin.test.assertFailsWith
import mockwebserver3.MockResponse
import mockwebserver3.MockWebServer
import mockwebserver3.SocketPolicy.DisconnectAtEnd
import okhttp3.CertificatePinner
import okhttp3.CertificatePinner.Companion.pin
import okhttp3.OkHttpClientTestRule
import okhttp3.RecordingHostnameVerifier
import okhttp3.Request
import okhttp3.internal.platform.Platform.Companion.get
import okhttp3.testing.PlatformRule

ml_dtypes >= 0.4.0, < 0.5.0
# Install tensorboard, and keras
# Note that here we want the latest version that matches TF major.minor version
# Note that we must use nightly here as these are used in nightly jobs
# For release jobs, we will pin these on the release branch
keras-nightly ~= 3.0.0.dev
tb-nightly ~= 2.19.0.a
# Test dependencies
grpcio >= 1.24.3, < 2.0
portpicker == 1.6.0
scipy >= 1.13.0
requests >= 2.31.0
packaging==23.2
setuptools==70.0.0

ml_dtypes >= 0.4.0, < 0.5.0
# Install tensorboard, and keras
# Note that here we want the latest version that matches TF major.minor version
# Note that we must use nightly here as these are used in nightly jobs
# For release jobs, we will pin these on the release branch
keras-nightly ~= 3.0.0.dev
tb-nightly ~= 2.18.0.a
# Test dependencies
grpcio >= 1.24.3, < 2.0
portpicker == 1.6.0
scipy == 1.11.3
requests >= 2.31.0
packaging==23.2
setuptools==70.0.0

You can learn more about [FastAPI versions and how to pin and upgrade them](https://fastapi.tiangolo.com/deployment/versions/) for your project in the docs.

## Reporting a Vulnerability

  /**
   * Returns true if the host and port are unchanged from when this was created. This is used to
   * detect if followups need to do a full connection-finding process including DNS resolution, and
   * certificate pin checks.
   */
  fun sameHostAndPort(url: HttpUrl): Boolean

  /**
   * A plan holds either an immediately-usable connection, or one that must be connected first.