Apache HttpClient 5.6.1

[chris-mcc]

Describe the feature

Hi,

Apache httpclient5 is now at 5.6.1

Like httpcore it has some good fixes
https://downloads.apache.org/httpcomponents/httpclient/RELEASE_NOTES-5.6.x.txt

Use Case

New version has good fixes: https://downloads.apache.org/httpcomponents/httpclient/RELEASE_NOTES-5.6.x.txt

Proposed Solution

update pom to be
<httpcomponents.client5.version>5.6.1</httpcomponents.client5.version>

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Java SDK version used

2.42.40

JDK version used

25.0.3

Operating System and version

ubuntu 24.04.4 6.17.22

[debora-ito]

Acknowledged. We are close to merge #6732, will do a version bump after.

[klach-ocado]

I'd add one (maybe controversial) consideration for future: Please do not blindly update dependencies but rather keep them aligned with some "reasonable baseline", like Spring Boot. E.g. current Spring Boot 4.0.6 declares Apache HttpClient 5.5.2 (https://github.com/spring-projects/spring-boot/blob/v4.0.6/platform/spring-boot-dependencies/build.gradle#L656), a release candidate for the next version declares 5.6.1 (https://github.com/spring-projects/spring-boot/blob/v4.1.0-RC1/platform/spring-boot-dependencies/build.gradle#L728), so AWS SDK may already be incompatible with even up-to-date Spring Boot applications.

In our case accidental use of Apache HttpClient 5.6 on Spring Boot 4.0-based app lead to a production incident. The opposite relation, AWS SDK requiring 5.6 while dependency management delivering 5.5, also can lead to binary incompatibilities.

[cmcclung-ANGENG]

That's a good point

Were you affected by

Compatibility notes:

• As of this version, HttpClient uses BUILTIN
  HostnameVerificationPolicy by default, delegating host verification to
  JSSE security manager. One must explicitly configure the TLS strategy
  to continue using the hostname verifier shipped with HttpClient.

• Five-second TCP keep-alive is now enabled by default.

Wondering what the difference was that caused the issue, the code in the repo will have to be tested for spring boot 4 and 4.1 compatibility.

[klach-ocado]

To clarify, the mentioned fail was not through AWS SDK but through other code relying on Apache HttpClient. One case was stronger validation of headers and the code not compatible with that. Another I heard of but I didn't participate directly was handling of asynchronous processing where older version propagated exception and cleared resources properly while newer one left async exchanges hanging. The process-related reason of those failures was that when Spring Boot minor version is updated, it's usually tested more extensively as breaking changes are expected; when there was a random bump of a version of some library, we didn't expect such issues.

[cmcclung-ANGENG]

Ah,

Yeah, Http headers are a pain to do right, by the spec

The apache5-client has targeted 5.6 from GA and bumped up the core versions

Perhaps Spring boot need to be made aware as a fyi in time for the 4.0.7 and 4.1 releases as they are milestoned to be at the same time

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.