On Wed, 2026-08-12 at 09:39 -0700, Ryan Schmitt wrote: > +1 > > I found two non-blocking issues while running the integration tests > on this > release: > > Breaking change to an internal constructor: > https://github.com/apache/httpcomponents-client/commit/585893d80953eca17a2fed7d035843f934c94c96#diff-52a4850a8da09265627c2e9417d7a49aeb52f39e3d8363eacf4052797d4a2b0d > I think the addition of `connPoolListener` means we no longer need to > call > the internal API anyway, so who cares. > > Bugfix revealing missing `HostnameVerificationPolicy` config > override: > https://github.com/apache/httpcomponents-client/commit/a890ec765d970cce3d7d2308ecacc1b16158f9f0 > I recall that the analogous change on the classic transport pissed > some > people off, but if we got away with that, then this will be fine. > Additionally, `setHostVerificationPolicy` has been present since 5.5, > and > the older non-chainable variant `setHostnameVerificationPolicy` has > been > present since 5.4, so forward-compatibility isn't an issue.
Hi Ryan Do you still remember the context of the analogous change on the classic transport pissing some people off? The a890ec765d970cce3d7d2308ecacc1b16158f9f0 change-set actually represents a fix to a fairly major vulnerability I have introduced by a dumb mistake. I just want to make sure I have not missed something important. Oleg --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
