neilscallywag opened a new issue, #1954: URL: https://github.com/apache/maven-resolver/issues/1954
### New feature, improvement proposal Hi maintainers, Could the project please consider migrating maven-resolver-transport-apache away from the older Apache HttpComponents coordinates: HttpComponents coordinates: - [org.apache.httpcomponents:httpcore](https://mvnrepository.com/artifact/org.apache.httpcomponents/httpcore) and [org.apache.httpcomponents:httpclient](https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient) The newer coordinates are: - [org.apache.httpcomponents.core5:httpcore5](https://mvnrepository.com/artifact/org.apache.httpcomponents.core5/httpcore5) and [org.apache.httpcomponents.client5:httpclient5](https://mvnrepository.com/artifact/org.apache.httpcomponents.client5/httpclient5) [The developers also recommend moving to the newer versions](https://lists.apache.org/thread/qpnhw3ybsx2jq2oknzroq90jh5xts8lo) and the older coordinates appear to no longer be actively maintained. Our build scanners have also highlighted a CVE (similar to the OP of the thread) affecting HttpCore 5 which, according to the attached Apache discussion, may also affect version 4. Apache maintainers indicated that a public patch for version 4 may not be released. For info, we are not affiliated with the poster of the attached apache thread. I understand that HttpComponents 5 may not be a drop-in compatible with 4.x and that this would require implementation and testing changes rather than only updating the coordinates. Some of our services depend transitively on httpcomponents library, so we are approaching the developers down the chain to ask them to upgrade, [example](https://github.com/smallrye/smallrye-beanbag/issues/280). We have a workaround specific for our use case in the time being so it is not an issue that requires urgency. Thanks :) !! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
