apache / apache/maven-resolver
[MRESOLVER-1954] Provide Apache HttpClient 5.x transporter module (maven-resolver-transport-apache5)
- Dominant language
- Java
- Stars
- 152
- Forks
- 160
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 49
Description
### New feature, improvement proposal
Hi maintainers,
Could the project please consider migrating maven-resolver-transport-apache away from the older Apache HttpComponents coordinates:
HttpComponents coordinates: - [org.apache.httpcomponents:httpcore](https://mvnrepository.com/artifact/org.apache.httpcomponents/httpcore) and [org.apache.httpcomponents:httpclient](https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient)
The newer coordinates are: - [org.apache.httpcomponents.core5:httpcore5](https://mvnrepository.com/artifact/org.apache.httpcomponents.core5/httpcore5) and [org.apache.httpcomponents.client5:httpclient5](https://mvnrepository.com/artifact/org.apache.httpcomponents.client5/httpclient5)
[The developers also recommend moving to the newer versions](https://lists.apache.org/thread/qpnhw3ybsx2jq2oknzroq90jh5xts8lo) and the older coordinates appear to no longer be actively maintained. Our build scanners have also highlighted a CVE (similar to the OP of the thread) affecting HttpCore 5 which, according to the attached Apache discussion, may also affect version 4. Apache maintainers indicated that a public patch for version 4 may not be released. For info, we are not affiliated with the poster of the attached apache thread.
I understand that HttpComponents 5 may not be a drop-in compatible with 4.x and that this would require implementation and testing changes rather than only updating the coordinates.
Some of our services depend transitively on httpcomponents library, so we are approaching the developers down the chain to ask them to upgrade, [example](https://github.com/smallrye/smallrye-beanbag/issues/280). We have a workaround specific for our use case in the time being so it is not an issue that requires urgency.
Thanks :) !!
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the existing maven-resolver-transport-apache module and its implementation and tests, then compare the required Apache HttpClient 5.x coordinates with the current transport. Done means providing a tested maven-resolver-transport-apache5 module that works with the newer HttpComponents APIs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100