| The geoserver release process collects all jars for all extensions in a single maven process when building extensions. This means that when there are conflicting jar versions, it will choose some arbitrary version from among the valid ones. In this instance, various extension depend on numerous httpclient and httpcore versions:
When running mvn -Prelease assembly:attached, we wind up with httpcore 4.3.3 and httpclient 4.2.5. Note that httpcore is a dependency of httpclient and they should match versions. PR which explicitly declares these dependancies as version 4.3.3 in the release project can be found here: https://github.com/geoserver/geoserver/pull/1652 4.3.3 was chosen based on the most common / safe jar among all dependencies |