HttpClient version 4.3 -> 4.5 ?

[Brent Putman]

On 10/18/16 9:32 PM, Tom Zeller wrote:
>> At this point, I'd propose we do it for a 3.4.
> Agree, but perhaps we should bundle updating HC with Java 8 and Spring
> Framework 5, which would be more like 4.0.

We certainly can do that.  I've obviously not been in a big hurry to
upgrade HC.  I'm not a believer in upgrading to the newest, shiniest
version of something just because it's new and shiny.  In the absence
of any known security vulnerabilities or functionality bugs, I don't
think it's urgent...

>  Seems like Java and SF are
> less concerning than HC, 

... OTOH, I don't know for sure that is true.  HC is critical to us and
we make use of various advanced bits, but Java and Spring are "bigger",
so it's a tossup.  When I get some time to actually look in detail at
HC 4.5, it may be that my initial concerns were unfounded and upgrading
will be no big deal.

IIRC the main red flag was I think it goes out and attempts to
automatically download some public suffix stuff, but hopefully there's
an easy way to turn that off.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20161019/222004c9/attachment.html>