Plans to upgrade HttpClient to latest ?

[Brent Putman]

On 9/3/15 2:11 PM, Tom Zeller wrote:
> Do we have plans to upgrade HttpClient from 4.3.6 to 4.5 or 4.4 or ?

I have it on my TODO list to investigate before the 3.2.0 release. I
looked at the newer one(s) briefly when I was doing the SOAP client
stuff, and the custom TLS bits, and TODO-ed it at the time to avoid
getting sidetracked.


> Not a big deal, I ask because the latest Selenium has a dependency on 4.4.1. Not sure if there was a reason to stay on 4.3.

Don't know yet.  IIRC there might have been some API changes that I
wanted to vet related to the TLS socket factories, and maybe some other
things they deprecated which we might need to address to avoid falling
out of sync.

Also IIRC the big thing I saw between 4.3.x and 4.4.x was that business
with the public suffix stuff they introduced.  Wanted to really get a
handle on that before updating.  We might want to figure out how to turn
all that off, if possible:

* Default SSL hostname verifier and default cookie policy now validate
certificate identity and cookie domain of origin against the public
suffix list maintained by Mozilla.org <https://publicsuffix.org/list>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150903/004adc47/attachment.html>