You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/08/12 19:28:15 UTC
[PR] Bump org.apache.httpcomponents.core5:httpcore5 from 5.3 to 5.4.3 [flink-connector-prometheus]
dependabot[bot] opened a new pull request, #27:
URL: https://github.com/apache/flink-connector-prometheus/pull/27
Bumps [org.apache.httpcomponents.core5:httpcore5](https://github.com/apache/httpcomponents-core) from 5.3 to 5.4.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/apache/httpcomponents-core/blob/rel/v5.4.3/RELEASE_NOTES.txt">org.apache.httpcomponents.core5:httpcore5's changelog</a>.</em></p>
<blockquote>
<h2>Release 5.4.3</h2>
<p>This maintenance release fixes several defects and regression reported sicne the previous
release includin a regression in backpressure handling of async TLS sessions introduced in
version 5.3.3.</p>
<h2>Change Log</h2>
<ul>
<li>
<p>HTTPCORE-796: abort redirected requests during the expect-continue handshake the same
way as errors.
Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p>
</li>
<li>
<p>Fixed regression in backpressure handling of async TLS sessions. Reverts HTTPCORE-775.
Contributed by Ryan Schmitt <!-- raw HTML omitted --></p>
</li>
<li>
<p>Use max line length of 8192 and max header count of 100 for incoming HTTP/1 messages
by default.
Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p>
</li>
<li>
<p>Enforce configured HPACK header list size limit upon initialization of HTTP/2
connections.
Contributed by Arturo Bernal <!-- raw HTML omitted --></p>
</li>
<li>
<p>HTTPCORE-774: fixed a race condition caused by concurrent update of the connection input
window to the max value (ported from 5.3.x; omitted by mistake).
Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p>
</li>
<li>
<p>Ensure async data consumers can avoid NPE if they have been canceled or released from another
thread at the same with concurrent data processing.
Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p>
</li>
<li>
<p>Fixed connection pool lease timeout race potentially causing pool entry leak (<a href="https://redirect.github.com/apache/httpcomponents-core/issues/649">#649</a>).
Contributed by Arturo Bernal <!-- raw HTML omitted --></p>
</li>
</ul>
<h2>Release 5.4.2</h2>
<p>This maintenance release fixes a bug in the lax connection pool where expired
connection cleanup fails to update the number of available connections,
potentially causing the client to eventually deadlock. Two other fixes are
included as well, one for a memory leak in the implementation of HTTP/2 stream
priority and one in the parseLenient method, which should ignore illegal
character names.</p>
<h2>Change Log</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/apache/httpcomponents-core/commit/d5d0c2032b8d8012577c18321dfd64a563dc3c6d"><code>d5d0c20</code></a> HttpCore 5.4.3 release</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/172871df38f717c4ae4684f48630395295af0468"><code>172871d</code></a> Updated release notes for HttpCore 5.4.3 release</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/496c2f5e114d031b53f180b50fa0e7a0ce7e3916"><code>496c2f5</code></a> HTTPCORE-796: abort redirected requests during the expect-continue handshake ...</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/1391b7aa21338b6b6eaa1883c0d0e307f3396ac0"><code>1391b7a</code></a> SSLIOSession: Fix regression in backpressure handling</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e"><code>d96a00f</code></a> Use max line length of 8192 and max header count of 100 for incoming HTTP/1 m...</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e"><code>1ea1239</code></a> Enforce configured HPACK header list size limit on initialization</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/af61c1ea5a852caeece257e7fa8295365db765fa"><code>af61c1e</code></a> HTTPCORE-774: fixed a race condition caused by concurrent update of the conne...</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/0363ff3866fa4631f3a07bf83a7e8da5653fb514"><code>0363ff3</code></a> Ensure async data consumers can avoid NPE if they have been canceled / releas...</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/024b199cd3f05459062376fc5c576d083c80832d"><code>024b199</code></a> Fix lease timeout race to prevent pool entry leak (<a href="https://redirect.github.com/apache/httpcomponents-core/issues/649">#649</a>)</li>
<li><a href="https://github.com/apache/httpcomponents-core/commit/25c73526a19fe1c07910b27deadeb25997581b60"><code>25c7352</code></a> Upgraded HttpCore version to 5.4.3-SNAPSHOT</li>
<li>Additional commits viewable in <a href="https://github.com/apache/httpcomponents-core/compare/rel/v5.3...rel/v5.4.3">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/flink-connector-prometheus/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org