Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 29, 2025

Bumps org.apache.httpcomponents.client5:httpclient5 from 5.5 to 5.5.1.

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.5.1

This is a maintenance release that fixes several defects in the connection management code and a regression in the DIGEST authentication reported since the previous release. It also upgrades HttpCore to version 5.3.6.

Change Log

  • HTTPCLIENT-2391: Improved GRACEGUL shutdown of ExecutorService used internally by async clients. Contributed by Oleg Kalnichevski

  • Bug fix: Use a 1 second timeout when closing out connections inside a connection pool lock. Contributed by Oleg Kalnichevski

  • Clarified the behavior of the protocol-level responseTimeout and the connection management level socketTimeout and their interrelation. Contributed by ChangYong

  • Bug fix: Connection managers to ensure open connections have a socket timeout set based on ConnectionConfig upon lease. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2393: Remove rspauth attribute from Authorization DIGEST header (#716) RFC 7616 compliance: rspauth is server-side (Authentication-Info 3.5) only. Contributed by Arturo Bernal

  • HTTPCLIENT-2386: Classic transport to use the connect timeout as a default if the TLS timeout has not been explicitly set. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2384: Socket options related to TcpKeepAlive are ignored. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2371: Logging of request re-execution at INFO priority. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2379: Fixed a defect in H2SharingConnPool causing an IllegalStateException when releasing the same connection from multiple threads. (#663) Contributed by Arturo Bernal [email protected]

  • Fixed the behavior of the validateAfterInactivity connection setting by the async connection manager. Contributed by Ryan Schmitt

  • HTTPCLIENT-2376: Fixed the problem with ContentCompressionExec not taking acceptEncoding parameter into account.

... (truncated)

Commits
  • 6a3d332 HttpClient 5.5.1 release
  • 66dea80 Updated release notes for HttpClient 5.5.1 release
  • 61f21a5 Upgraded HttpCore to version 5.3.6
  • 694394c HTTPCLIENT-2391: improved GRACEGUL shutdown of ExecutorService used internall...
  • 038b74f Bug fix: Use 1 second timeout when closing out connections inside a connectio...
  • 6675520 Clarify behavior of the protocol level responseTimeout and the connection man...
  • cb2ccda Bug fix: connections managers to ensure open connections have socket timeout ...
  • 4466cca HTTPCLIENT-2393 - remove rspauth from Authorization (#716)
  • da1a8e0 Imporved TestAsyncClient wiring; added internal methods to get the underlying...
  • ab40ec9 Upgraded HttpCore to version 5.3.5
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.5 to 5.5.1.
- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.5.1/RELEASE_NOTES.txt)
- [Commits](apache/httpcomponents-client@rel/v5.5...rel/v5.5.1)

---
updated-dependencies:
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Sep 29, 2025
@davewichers davewichers merged commit a2ffbe8 into main Sep 29, 2025
2 checks passed
@dependabot dependabot bot deleted the dependabot/maven/org.apache.httpcomponents.client5-httpclient5-5.5.1 branch September 29, 2025 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant