apache / apache/maven-resolver

[MRESOLVER-1954] Provide Apache HttpClient 5.x transporter module (maven-resolver-transport-apache5)

Open
#1,954 4 comments 0 reactions 0 assignees View on GitHub
dependencies priority:major
Dominant language
Java
Stars
152
Forks
160
Avg merge
1d 4h
Merged PRs (30d)
49

Description

### New feature, improvement proposal

Hi maintainers,

Could the project please consider migrating maven-resolver-transport-apache away from the older Apache HttpComponents coordinates:

HttpComponents coordinates: - [org.apache.httpcomponents:httpcore](https://mvnrepository.com/artifact/org.apache.httpcomponents/httpcore) and [org.apache.httpcomponents:httpclient](https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient)

The newer coordinates are: - [org.apache.httpcomponents.core5:httpcore5](https://mvnrepository.com/artifact/org.apache.httpcomponents.core5/httpcore5) and [org.apache.httpcomponents.client5:httpclient5](https://mvnrepository.com/artifact/org.apache.httpcomponents.client5/httpclient5)

[The developers also recommend moving to the newer versions](https://lists.apache.org/thread/qpnhw3ybsx2jq2oknzroq90jh5xts8lo) and the older coordinates appear to no longer be actively maintained. Our build scanners have also highlighted a CVE (similar to the OP of the thread) affecting HttpCore 5 which, according to the attached Apache discussion, may also affect version 4. Apache maintainers indicated that a public patch for version 4 may not be released. For info, we are not affiliated with the poster of the attached apache thread.

I understand that HttpComponents 5 may not be a drop-in compatible with 4.x and that this would require implementation and testing changes rather than only updating the coordinates.

Some of our services depend transitively on httpcomponents library, so we are approaching the developers down the chain to ask them to upgrade, [example](https://github.com/smallrye/smallrye-beanbag/issues/280). We have a workaround specific for our use case in the time being so it is not an issue that requires urgency.

Thanks :) !!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the existing maven-resolver-transport-apache module and its implementation and tests, then compare the required Apache HttpClient 5.x coordinates with the current transport. Done means providing a tested maven-resolver-transport-apache5 module that works with the newer HttpComponents APIs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.