build(deps): upgrade httpclient5 from 5.4.4 to 5.6.4 - #3079
Merged
Conversation
Bumps the shared apache.httpclient.version property, which pins org.apache.httpcomponents.client5:httpclient5 in client-v2 and clickhouse-http-client, to 5.6.4 to pick up the fixes of the newer 5.x releases, including known vulnerabilities. Fixes: #3078
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8318a06. Configure here.
|
Client V2 CoverageCoverage Report
Class Coverage
|
JDBC V2 CoverageCoverage Report
Class Coverage
|
JDBC V1 CoverageCoverage Report
Class Coverage
|
Client V1 CoverageCoverage Report
Class Coverage
|
chernser
approved these changes
Aug 26, 2026
Closed
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #3078.
The repository pinned
org.apache.httpcomponents.client5:httpclient5at5.4.4through the sharedapache.httpclient.versionproperty in the root POM. That property is used by the two modules that ship theApache HTTP transport:
client-v2andclickhouse-http-client. Older 5.x releases contain knownvulnerabilities, so the property is moved to
5.6.4(the current release), which also updates the artifactthat is shaded into
packages/clickhouse-jdbc-all.httpclient55.6.4 still targets Java 8 (maven.compiler.source/target = 1.8in its parent POM), so theminimum supported Java version of this repository is unchanged. No source change is required: the
ConnectionSocketFactory/SSLConnectionSocketFactoryAPIs used byHttpAPIClientHelperandApacheHttpConnectionImplare deprecated but still present in 5.6.x, and they were already deprecated in5.4.4 - migrating them to
TlsSocketStrategyis a separate change and is out of scope here.Changes
pom.xml-apache.httpclient.version:5.4.4->5.6.4.CHANGELOG.md- newUpdated Dependenciesentry for0.11.0-rc1.Out of scope (not shipped artifacts, handled separately by Dependabot):
examples/jdbc/pom.xml(5.2.1)and
performance/pom.xml(5.3.1).Test
A dependency upgrade has no behavior of its own to pin with a new test, so it is verified by building and by
running the existing HTTP-transport suites on both versions:
mvn -B -DskipTests install- BUILD SUCCESS for all reactor modules, including the shadedpackages/clickhouse-jdbc-all(the shade log confirmshttpclient5-5.6.4).mvn -B -pl client-v2,clickhouse-http-client test- 649 unit tests, 0 failures.mvn -B -pl jdbc-v2 test- 1499 unit tests, 0 failures.mvn -B -pl client-v2 -Dit.test=HttpTransportTests verify- 93 integration tests. The same 27 failuresoccur with
5.6.4and with-Dapache.httpclient.version=5.4.4(SSL, proxy and named-test-user cases thatneed the CI server fixtures), so the upgrade introduces no new failure.
mvn -B -pl clickhouse-http-client -Dit.test=ApacheHttpConnectionImplTest verify- 195 integration tests,3 failures, all environmental (no proxy; server certificate CN is
localhost).Pre-PR validation gate
5.4.4docs/features.mdunaffected)