Skip to content

Bump apache-httpclient5.version to 5.6.2, apache-httpcore5.version to 5.4.3#26613

Open
thll wants to merge 5 commits into
masterfrom
change/apache-http-5-deps-mgmt
Open

Bump apache-httpclient5.version to 5.6.2, apache-httpcore5.version to 5.4.3#26613
thll wants to merge 5 commits into
masterfrom
change/apache-http-5-deps-mgmt

Conversation

@thll

@thll thll commented Jul 7, 2026

Copy link
Copy Markdown
Contributor
  • Uses the latest available versions for the apache-httpclient5.version and apache-httpcore5.version properties.
  • Adds management for org.apache.httpcomponents.core5:httpcore5 and org.apache.httpcomponents.core5:httpcore5-h2 dependencies.
  • Disables transparent content compression on the http client used by the OpenSearch client which causes issues while we are on opensearch-java < 3.6.0.

/prd https://github.com/Graylog2/graylog-plugin-enterprise/pull/14787
/nocl

@thll

thll commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Currently blocked by a pending update of our opensearch-java dependency, which we'd need to bump to at least 3.6.0 to have opensearch-project/opensearch-java#1851 included.

@thll

thll commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

If we decide not to update opensearch-java, we can add

            httpClientBuilder.disableContentCompression();

As a workaround to org.graylog.storage.opensearch3.OfficialOpensearchClientProvider#buildTransport. But with that workaround in place, we would have to make sure that we remove it again, once we update opensearch-java.

thll and others added 4 commits July 9, 2026 14:15
A gzip-encoded response must be decompressed by exactly one layer:
opensearch-java < 3.6.0 decompresses itself, so HttpClient's transparent
decompression (default since HttpClient 5.6) must be disabled; from
opensearch-java 3.6.0 on it's the other way around. This test fails in
either misconfiguration, in particular when disableContentCompression()
outlives a future opensearch-java upgrade.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@thll thll marked this pull request as ready for review July 9, 2026 15:49
@thll thll requested review from bernd and kroepke July 9, 2026 15:50
@thll

thll commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

I've decided to move forward with this independently from an update of opensearch-java. For that, I've disabled content compression on the client level and added a trip-wire test that will fail when opensearch-java is updated but the workaround left in place.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant