Bump org.apache.httpcomponents.client5:httpclient5 from 5.5.1 to 5.6.4 - #2669
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.5.1 to 5.6.4. - [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt) - [Commits](apache/httpcomponents-client@rel/v5.5.1...rel/v5.6.4) --- updated-dependencies: - dependency-name: org.apache.httpcomponents.client5:httpclient5 dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
|
@eddumelendez we need this one to address CVE-2026-71290 |
|
Thanks for preparing this dependency update. We are qualifying a Java 21 integration testkit using Testcontainers 2.0.5, which constructs docker-java-transport-zerodep 3.7.1 directly. The released carrier embeds HttpClient 5.5.1 and HttpCore 5.3.6; overriding ordinary Maven/Gradle coordinates does not replace these relocated classes. PR #2669 upgrades HttpClient to 5.6.4 and its recorded CI checks pass. Is there an expected maintained release containing this change, or a published candidate that downstream consumers should qualify? We have not found a patched released carrier. We can qualify the resulting release in our optional container integration lane and report compatibility results. For context, our native inventory currently matches GHSA-hf6x-8p5f-cgmf, GHSA-v3jc-474w-2wm6, and GHSA-hjcp-jmpx-g3qm against the embedded HTTP components. This is a dependency-inventory observation, not a claim of a demonstrated exploit in docker-java. |
Bumps org.apache.httpcomponents.client5:httpclient5 from 5.5.1 to 5.6.4.
Changelog
Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.
... (truncated)
Commits
36508ceHttpClient 5.6.4 release59b3d2eUpdated release notes for HttpClient 5.6.4 releasec0af759reject control characters in bearer token in BearerScheme2422b6cCorrects application of SSL parameters in the async TLS upgrade method66452eaUpgraded HttpClient version to 5.6.4-SNAPSHOT58728b1Updated release notes for HttpClient 5.6.3 release55733f4ContentCompressionExec fails to close the underlying response stream in case ...2485ddfDo not call the backend when an only-if-cached request cannot be served from ...26ece37compare scheme in redirect same-authority check8cdf6faescape quotes and strip line breaks in rfc7578 multipart parametersYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)