Update to Apache Http Client 4.5.13

[sberyozkin]

No description provided.

[gastaldi]

Maybe add to Dependabot too? Or is there a reason to not be in there?

[sberyozkin]

Hi @gastaldi sorry, sure I'll update the dependabout config, this build has failed (likely for unrelated reason), but I'll update the PR anyway

[sberyozkin]

@gastaldi it is already there :-), - dependency-name: org.apache.httpcomponents:httpclient

[gsmet]

The issue is that you have ${httpclient.version} used for other artifacts that are not in the Dependabot config. That's why it's not updated.

Now I'm not entirely sure how to update this given httpcore probably needs to be synced.

[sberyozkin]

@gsmet, @gastaldi interesting, httpcore has a different version, may be adding httpclient-cache and httpclient-mime can make dependabot happy ? Pity it is not possible to use a wildcard :-), dependency-name: org.apache.httpcomponents:http*

[gsmet]

Wildcards are supposed to be supported now.

And yes, that would make Dependabot happy. What I was mentioning is that there's a good chance you need to update httpcore when upgrading the httpclient artifacts.

Anyway, let's do it in another PR, I would like to get this one CI-tested and backported.

[sberyozkin]

@gsmet I see what you meant about http-core :-). Tricky, I was not sure about the wildcard as it is the same group id but indeed, it can be reviewed later. thanks

[gsmet]

Rebased to get a CI fix.

[gastaldi]

Dumb question: In https://hc.apache.org/downloads.cgi it says that the latest is 5.0.3 - why we aren't using that?

UPDATE: Ignore me, that's the HTTP Core version
UPDATE 2: Actually no, there is Apache HttpClient 5.0.3. I suppose because the package name changed?

[sberyozkin]

Hey @gastaldi I haven't thought about 5.0.3, and indeed I'm not sure about the implications

[rsvoboda]

@gsmet What is this upgrade fixing for 1.7 branch?

[gsmet]

See https://issues.redhat.com/browse/QUARKUS-490