New feature, improvement proposal
Hi maintainers,
Could the project please consider migrating maven-resolver-transport-apache away from the older Apache HttpComponents coordinates:
HttpComponents coordinates: - org.apache.httpcomponents:httpcore and org.apache.httpcomponents:httpclient
The newer coordinates are: - org.apache.httpcomponents.core5:httpcore5 and org.apache.httpcomponents.client5:httpclient5
The developers also recommend moving to the newer versions and the older coordinates appear to no longer be actively maintained. Our build scanners have also highlighted a CVE (similar to the OP of the thread) affecting HttpCore 5 which, according to the attached Apache discussion, may also affect version 4. Apache maintainers indicated that a public patch for version 4 may not be released. For info, we are not affiliated with the poster of the attached apache thread.
I understand that HttpComponents 5 may not be a drop-in compatible with 4.x and that this would require implementation and testing changes rather than only updating the coordinates.
Some of our services depend transitively on httpcomponents library, so we are approaching the developers down the chain to ask them to upgrade, example. We have a workaround specific for our use case in the time being so it is not an issue that requires urgency.
Thanks :) !!
New feature, improvement proposal
Hi maintainers,
Could the project please consider migrating maven-resolver-transport-apache away from the older Apache HttpComponents coordinates:
HttpComponents coordinates: - org.apache.httpcomponents:httpcore and org.apache.httpcomponents:httpclient
The newer coordinates are: - org.apache.httpcomponents.core5:httpcore5 and org.apache.httpcomponents.client5:httpclient5
The developers also recommend moving to the newer versions and the older coordinates appear to no longer be actively maintained. Our build scanners have also highlighted a CVE (similar to the OP of the thread) affecting HttpCore 5 which, according to the attached Apache discussion, may also affect version 4. Apache maintainers indicated that a public patch for version 4 may not be released. For info, we are not affiliated with the poster of the attached apache thread.
I understand that HttpComponents 5 may not be a drop-in compatible with 4.x and that this would require implementation and testing changes rather than only updating the coordinates.
Some of our services depend transitively on httpcomponents library, so we are approaching the developers down the chain to ask them to upgrade, example. We have a workaround specific for our use case in the time being so it is not an issue that requires urgency.
Thanks :) !!