capability.

 *  Fix: Don't crash on `trailers()` if the response doesn't have a body. We broke [Retrofit] users
    who read the trailers on the `raw()` OkHttp response, after its body was decoded.


## Version 5.0.0

_2025-07-02_

This is our first stable release of OkHttp since 2023. Here's the highlights if you're upgrading
from OkHttp 4.x:

    assertThat(url.queryParameter("a")).isEqualTo("!$(),/:;?@[]\\^`{|}~")
  }

  /**
   * When callers use `addEncodedQueryParameter()` we only encode what's strictly required. We
   * retain the encoded (or non-encoded) state of the input.
   */
  @Test
  fun queryCharactersNotReencodedWhenComposedWithAddEncoded() {
    val url =
      HttpUrl
        .Builder()
        .scheme("http")

    throw IllegalArgumentException("failed to decode certificate", nsee)
  } catch (iae: IllegalArgumentException) {
    throw IllegalArgumentException("failed to decode certificate", iae)
  } catch (e: GeneralSecurityException) {
    throw IllegalArgumentException("failed to decode certificate", e)
  }
}

/**
 * Returns the certificate encoded in [PEM format][rfc_7468].
 *

  public val bodySize: Long,
  /**
   * The sizes of the chunks of this request's body, or null if the request's body was not encoded
   * with chunked encoding.
   */
  public val chunkSizes: List<Int>?,
  /**
   * The failure MockWebServer recorded when attempting to decode this request. If, for example,
   * the inbound request was truncated, this exception will be non-null.
   */

  }

  @Test fun `cannot decode malformed utc time`() {
    val bytes = "170d3139313231362333303231305a".decodeHex()
    assertFailsWith<ProtocolException> {
      Adapters.UTC_TIME.fromDer(bytes)
    }.also { expected ->
      assertThat(expected).hasMessage("Failed to parse UTCTime 191216#30210Z")
    }
  }

  @Test fun `cannot decode generalized time with offset`() {

    the proxy selectors are different. Ugh!


## Version 4.2.0

_2019-09-10_

 *  New: API to decode a certificate and private key to create a `HeldCertificate`. This accepts a
    string containing both a certificate and PKCS #8-encoded private key.

    ```kotlin
    val heldCertificate = HeldCertificate.decode("""
        |-----BEGIN CERTIFICATE-----
        |MIIBYTCCAQegAwIBAgIBKjAKBggqhkjOPQQDAjApMRQwEgYDVQQLEwtlbmdpbmVl

  private const val PREFIX_5_BITS = 0x1f
  private const val PREFIX_6_BITS = 0x3f
  private const val PREFIX_7_BITS = 0x7f

  private const val SETTINGS_HEADER_TABLE_SIZE = 4_096

  /**
   * The decoder has ultimate control of the maximum size of the dynamic table but we can choose
   * to use less. We'll put a cap at 16K. This is arbitrary but should be enough for most purposes.
   */

    }

    /**
     * Downloads a log file by its encoded ID.
     *
     * @param id the Base64 encoded filename of the log file to download
     * @return ActionResponse containing the log file stream
     */
    @Execute
    @Secured({ ROLE, ROLE + VIEW })
    public ActionResponse download(final String id) {

  private val bytesIn = Buffer()
  private val hpackReader = Hpack.Reader(bytesIn, 4096)

  protected fun testDecoder(story: Story) {
    for (testCase in story.cases) {
      val encoded = testCase.wire ?: continue
      bytesIn.write(encoded)
      hpackReader.readHeaders()
      assertSetEquals(
        "seqno=$testCase.seqno",
        testCase.headersList,
        hpackReader.getAndResetHeaderList(),
      )
    }
  }

      |-----END PRIVATE KEY-----
      |
      """.trimMargin()
    try {
      decode(certificatePem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a private key")
    }
    try {
      decode(pkcs8Pem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {