HttpComponents HttpCore 4.x - End of Life Notification (EOL)

[tporeba]

Describe the feature

Hi,
I got feedback from vulnerability scanner, that one of your dependency - httpcore:4.4.16 is End Of Life and no longer maintained, which means it does not receive security fixes.

aws-sdk-java-v2/pom.xml

Line 191 in 1926819

<httpcomponents.httpcore.version>4.4.16</httpcomponents.httpcore.version>

IMPORTANT: HttpCore 4 is at End of Life and is no longer being developed or supported. The users of HttpCore 4 are strongly encouraged to upgrade to HttpCore 5.

https://hc.apache.org/httpcomponents-core-4.4.x/index.html

Are there any plans to migrate to the maintained newer version - HttpCore 5?

Use Case

Compliance with security guidelines about use of EOL dependencies.

Proposed Solution

Upgrade to HttpCore 5

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Java SDK version used

2.42.36

JDK version used

openjdk version "11.0.29"

Operating System and version

Amazon Linux 2023.11.20260406

[debora-ito]

Hi @tporeba thank you for reaching out.

Apache5 is supported now, and we are working to change the default client from apache-client to apache5-client, you can track the work here: #6732.

[debora-ito]

Closing this. Apache 5 is the default client as of v2.46.0, see more info in the announcement.

If you use S3 clients with cross-region enabled, there is an active issue we are investigating, tracking in #7047.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.