Source: commons-httpclient Version: 3.1-10.2 Severity: important Quoting https://hc.apache.org/httpclient-3.x/
"The Commons HttpClient project is now end of life, and is no longer being developed. It has been replaced by the Apache HttpComponents project in its HttpClient and HttpCore modules, which offer better performance and more flexibility." I think it would be best to retire this library during the Stretch release cycle and to switch all reverse-dependencies to https://packages.qa.debian.org/h/httpcomponents-client.html The current list of r-deps: Reverse-Build-Depends-Indep =========================== * activemq * ant-contrib * biomaj * commons-vfs * ivy * jajuk * jakarta-jmeter * jenkins * jenkins-htmlunit * jenkins-json * jftp * jspwiki * libexml-java * libjboss-common-java * libowasp-antisamy-java * libreoffice * libspring-java * maven-docck-plugin * mule * openid4java * wagon * wagon2 Reverse-Build-Depends ===================== * axis * eclipse * jabsorb * jackrabbit * jets3t * libopenws-java * libxmlrpc3-java * lucene-solr * not-yet-commons-ssl * spring-build * triplea * wsdl2c __ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use debian-j...@lists.debian.org for discussions and questions.