Release 5.6.2

------------------

This maintenance release upgrades HttpCore to the latest stable version and restores

lazy content decompression by the classic client transport.

Change Log

-------------------

* Upgraded HttpCore to version 5.4.3.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2422: Restore lazy content decompression. Defer construction of the

decompression stream until the response content is actually read.

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.6.1

------------------

This maintenance release disables experimental SCRAM auth scheme by default and

fixes SCRAM final response handling. The SCRAM auth scheme can be re-enabled by

choosing a custom auth scheme preference sequence that explicitly includes SCRAM auth.

Change Log

-------------------

* Fix SCRAM final response handling.

Contributed by Arturo Bernal <abernal at apache.org>

* Auth challenge parsing code improvement.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Add missing Javadoc for ConnectionConfig (#820).

Contributed by Gary Gregory <garydgregory at gmail.com>

* Bug fix: Corrected async message exchange cancellation logic in

InternalHttpAsyncExecRuntime.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2417: Honor TlsConfig attachment in async connect path.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2414: Fix Basic auth cache scoping across path prefixes (#802).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2415: Normalize CookieOrigin path for cookie matching (#803).

Contributed by Arturo Bernal <abernal at apache.org>

* Bug fix: Corrected sleep time calculation in IdleConnectionEvictor; use 1 minute sleep

time by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* DefaultManagedHttpClientConnection: Restore original socket timeout.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-2411: Use standard HTTP-date format for synthesized Date header (#775).

Contributed by Arturo Bernal <abernal at apache.org>

* Fix NPE in connection evictor setup (#774).

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.6

------------------

This is the first GA release in the 5.6 release series. It adds several features such as

transport content decompression and content compression for the async transport, support

for Unix sockets, experimental support for SCRAM-SHA-256 authentication scheme, and

Micrometer/OTel observations & metrics.

Commons Compress, Brotli codec, and ZStd codec are optional dependencies and get

wired into the execution pipeline only if present on the classpath.

Notable changes and features included in the 5.6 series:

* Unix domain socket support.

* Support for pluggable content codecs via Commons-Compress in the classic transport.

(optional).

* Support for transparent content decompression and content compression with `deflate`,

`gzip`, `zstd` (optional), and `brotli` (optional) codecs in the async transport.

* Micrometer/OTel observations & metrics (optinal).

* Off-lock connection disposal by the classic pooling connection manager. Experimental.

* SCRAM-SHA-256 authentication scheme (RFC 7804). Experimental.

* Request Priority support (RFC 9218). Experimental.

* OFFLOCK connection pool concurrency policy. Experimental.

Compatibility notes:

* As of this version, HttpClient uses BUILTIN HostnameVerificationPolicy by default, delegating

host verification to JSSE security manager. One must explicitly configure the TLS strategy

to continue using the hostname verifier shipped with HttpClient.

* Five-second TCP keep-alive is now enabled by default.

Change Log

-------------------

* Limit the length of the content codec list that can be processed automatically.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.4

Contributed by Oleg Kalnichevski <olegk at apache.org>

* OFFLOCK connection pool concurrency policy backed by RouteSegmentedConnPool (#765).

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.6 ALPHA1

------------------

This is the first ALPHA release in the 5.6 release series. It adds several features

such as transport content decompression and content compression for the async transport,

support for Unix sockets, experimental support for SCRAM-SHA-256 authentication scheme,

and Micrometer/OTel observations & metrics.

Commons Compress, Brotli codec, and ZStd codec are optional dependencies and get

wired into the execution pipeline only if present on the classpath.

Change Log

-------------------

* RequestConfig: Un-deprecate #setProxy.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* Stale connection check support in PoolingAsyncClientConnectionManager.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* ConnectionConfig: `#idleTimeout` support.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `brotli` codec (#720).

Contributed by Arturo Bernal <abernal at apache.org>

* SCRAM-SHA-256 authentication scheme (RFC 7804) (#718).

Contributed by Arturo Bernal <abernal at apache.org>

* Off-lock connection disposal in PoolingHttpClientConnectionManager (#726).

Contributed by Arturo Bernal <abernal at apache.org>

* Add SPKI pinning TLS decorator (#715).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2387: Micrometer/OTel observations & metrics (#706).

Contributed by Arturo Bernal <abernal at apache.org>

* Clarification of the behavior of the protocol level `responseTimeout` and the connection

management level `socketTimeout` and their interrelation.

Contributed by ChangYong <lcy9002 at naver.com>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `zstd` codec (#703).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `gzip` codec (#700).

Contributed by Arturo Bernal <abernal at apache.org>

* Enable new TcpKeepAlive options on Java 8.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* Unsupported content encoding to be treated as an error.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `deflate` codec.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2385: Default managed connection implementations now have public constructors

marked as internal (#692).

Contributed by winfriedgerlach <158032591+winfriedgerlach at users.noreply.github.com>

* HTTPCLIENT-2383: Bypass sensitive-header check in LaxRedirectStrategy (#676).

Contributed by Arturo Bernal <abernal at apache.org>

* Enable JEP 380 UDS support for sync client.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-2375 Support for pluggable Commons-Compress encoders (#657).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-1843: Support for pluggable Commons-Compress decoders (#651).

Contributed by Arturo Bernal <abernal at apache.org>

* Switched HostnameVerificationPolicy to BUILTIN by default

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Omit cookie spec registry when cookie management is disabled.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* java.nio.file.Body-based MIME body (#641).

Contributed by Gary Gregory <garydgregory at gmail.com>

* Unix domain socket support.

Contributed by Ryan Schmitt <rschmitt at apache.org>

Release 5.5

------------------

This is the first GA release in the 5.5 release series. This release finalizes the 5.5

APIs and adds several experimental features and improvements, such as request multiplexing

over a shared HTTP/2 connection and the Classic API facade acting as a compatibility

bridge between classic I/O client services and the asynchronous message transport used

internally.

Notable changes and features included in the 5.5 series:

* Improved conformance to RFC 7616 (HTTP Digest Access Authentication).

* The connection pool implementation acts as a caching facade in front of a standard

managed connection pool and shares already leased connections to multiplex message

exchanges over active HTTP/2 connections. Experimental.

* Extended Auth API and improved authentication protocol logic to support mutual

authentication.

* The Classic API facade now acts as a compatibility bridge between the classic I/O client

services (based on the standard InputStream / OutputStream model) and the asynchronous

message transport used internally. This is experimental.

* HTTP/2 support for the Fluent Facade (via Classic API facade). This is experimental.

Compatibility notes:

* As of this release, HttpClient does not automatically execute redirects if the original

request manually added headers that are considered sensitive.

Change Log

-------------------

* HTTPCLIENT-2367: Fixed NPE in InternalAbstractHttpAsyncClient by adding a null check for

resolvedTarget (#634).

Contributed by Arturo Bernal <abernal at apache.org>

* Fixed case of Cookie#HTTP_ONLY_ATTR

Contributed by Finn Petersen <[email protected]>

* Simplified ProtocolSwitchStrategy by leveraging ProtocolVersionParser (#627).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2364: Fixed incorrect re-binding of the upgraded SSL socket to the HTTP

connection by the #upgrade method of the DefaultHttpClientConnectionOperator.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2363: ensure requests have a scheme and an authority populated before

they get committed to the execution pipeline.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.3.4

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Disallow automatic request redirection if the original request contains potentially

sensitive headers.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2360: Enhance filename encoding in multipart/form-data per RFC 6266/5987

(#618).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Corrected APIs in ClientTlsStrategyBuilder to be compatible with Classic APIs.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Bump testcontainers.version from 1.20.4 to 1.20.6 #622.

Contributed by Gary Gregory <garydgregory at gmail.com>

* Bump org.junit:junit-bom from 5.11.4 to 5.12.2 #623, #632.

Contributed by Gary Gregory <garydgregory at gmail.com>

* Bump log4j.version from 2.23.1 to 2.24.3 #626.

Contributed by Gary Gregory <garydgregory at gmail.com>

Release 5.5 ALPHA1

------------------

This is the first ALPHA release in the 5.5 release series. It adds several experimental

features and improvements such as request multiplexing over a shared HTTP/2 connection

and the Classic API facade acting as a compatibility bridge between classic I/O client

services and the asynchronous message transport used internally.

Notable changes and features included in the 5.5 series:

* Improved conformance to RFC 7616 (HTTP Digest Access Authentication).

* The connection pool implementation acts as a caching facade in front of a standard

managed connection pool and shares already leased connections to multiplex message

exchanges over active HTTP/2 connections. Experimental.

* Extended Auth API and improved authentication protocol logic to support mutual

authentication.

* The Classic API facade acting as a compatibility bridge between the classic I/O client

services (based on the standard InputStream / OutputStream model) and the asynchronous

message transport used internally. Experimental.

* HTTP/2 support for the Fluent Facade (via Classic API facade). Experimental.

Change Log

-------------------

* Async transport can now be used internally by the Fluent Facade.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Classic over async bridge.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2356: Extended Auth APIs and authentication protocol logic to support mutual

authentication.

Contributed by Istvan Toth <stoty at apache.org>

* Decode Subject Alternative Names for IP, DNS, and binary data (#610).

Contributed by Arturo Bernal <abernal at apache.org>

* Do not add `Upgrade` header if `Connection` header is already present (the caller manually

manages connection state).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Avoid logging the HTTP message version where it can be a hint, not a protocol version.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Experimental connections pool implementation that acts as a caching facade in front of

a standard ManagedConnPool and shares already leased connections to multiplex message

exchanges over active HTTP/2 connections.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2350 - Refactored the connect method in DefaultHttpClientConnectionOperator

to enhance flexibility in address resolution, specifically allowing for direct handling

of unresolved addresses (#598).

Contributed by Arturo Bernal <abernal at apache.org>

* Enhanced DigestScheme for RFC 7616 Compliance and Expanded Hash Algorithm Support (#597).

Contributed by Arturo Bernal <abernal at apache.org>

* Added request interceptor to check the `Authentication-Info` header in HTTP Digest Access

Authentication (#596).

Contributed by Arturo Bernal <abernal at apache.org>

* Added client-side `rspauth` value for Digest auth, verifying server knowledge of shared

secret per RFC 7616. (#594).

Contributed by Arturo Bernal <abernal at apache.org>

* Corrected method chaining in ClientTlsStrategyBuilder.

Contributed by Osip Fatkullin <osip.fatkullin at gmail.com>

* HTTPCLIENT-2337: Sanitize X500Principal Logging in ClientTlsStrategy classes (#581).

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.4

------------------

This is the first GA release in the 5.4 release series. This release finalizes the 5.4 APIs,

upgrades HttpCore to version 5.3 and improves the Public Suffix matching algorithm implementation.

IMPORTANT! The new cache entry serialization format is incompatible with earlier

versions of HttpClient Cache. Persistent caches (file system based, Memcached, EhCAche

with object serialization) created with any earlier version MUST be flushed and re-populated

or the cache backend MUST be configured to use the old, deprecated cache entry serializer.

Notable changes and features included in the 5.4 series:

* Improved conformance to RFC 9110 (HTTP Semantics), RFC 7616 (HTTP Digest Access

Authentication), RFC 2617 (’Basic’ HTTP Authentication Scheme).

* UTF-8 encoding is used by default for text where appropriate.

* Compatibility with Java Virtual Threads and Java 21 Runtime.

* Redesign and rewrite of the HTTP caching protocol layer for better efficiency

and improved conformance to RFC 9111 (HTTP Caching).

* Cache control and context APIs.

* ETag APIs.

* TLS SNI and endpoint identification improvements.

* Support for RFC 2817 (Upgrading to TLS Within HTTP/1.1).

* Auth cache no longer makes use of Java serialization.

* Deprecation of ConnectionSocketFactory and LayeredConnectionSocketFactory.

* HttpContext optimization and performance improvement.

* Async cache is no longer considered experimental.

Change Log

-------------------

* HTTPCLIENT-2338: Put compress exec interceptor after retry exec interceptor.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.3.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Javadoc improvements.

Contributed by Gary Gregory <garydgregory at gmail.com>

* DeflateInputStream extends FilterInputStream

Contributed by Gary Gregory <garydgregory at gmail.com>

* HTTPCLIENT-2335: Added close() method with CloseMode parameter to CloseableHttpResponse.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2336: Corrected hostname identity verification logic.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2336: Updated PublicSuffixMatcher to use the 'formal algorithm' as specified

https://github.com/publicsuffix/list/wiki/Format#formal-algorithm.

Contributed by Adrian Woodhead <adrian.woodhead at humansecurity.com>

* Input streams returned by DecompressingEntity#getContent to support mark(int) and reset()

if the underlying stream does.

Contributed by Gary Gregory <garydgregory at gmail.com>

* Improved FQDN matching.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Removed @Experimental from async cache classes.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2333: Update execution scope upon request redirect to avoid re-execution

of the original request in case of an I/O error.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Re-introduced LaxRedirectStrategy from 4.x

Contributed by Otavio Prado <otavio.prado at sensedia.com>

Release 5.4 BETA1

------------------

This is the first BETA release in the 5.4 release series. It upgrades HttpCore to version

5.3-beta1 and adds a few minor improvements and fixes.

Change Log

-------------------

* HTTPCLIENT-2328: Blocking I/O connections to check if the opposite TLS endpoint

has been closed by the opposite endpoint while writing out request body.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Redesign of test server APIs and integration test setup.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2331: Skip cookie header generation if a Cookie header is already

present (#561).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2326: Propagate original proxy response to the caller in case of

HTTP CONNECT request failure.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2327: Propagate CancellationExceptions from MemcachedClient operations

as ResourceIOExceptions (#559).

Contributed by jattisha <jattisha at umich.edu>

* Callbacks for Connection initialization.

Contributed by Richard Tippl <richard.tippl at gmail.com>

* HTTPCLIENT-2325 Avoid adding "; charset=" for multipart/form-data requests

Contributed by Vladimir Sitnikov <sitnikov.vladimir at gmail.com>

Release 5.4 ALPHA2

------------------

This is the second and likely the last ALPHA release in the 5.3 release series.

It finalizes the new Cache API introduced in the previous ALPHA release and also

improves TLS customization for the classic transport, SNI and endpoint identification

support, authentication data caching, and HTTP context performance. It also introduces

support for optional TLS upgrades for HTTP/1.1 connections.

Change Log

-------------------

* HttpClientContext to use instance variables for standard attributes.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2151: Support for JSSE in-built endpoint identification.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Internal connection operators to make use of the target name from the request URI

authority.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* DefaultRoutePlanner to take the request authority into account when determining a route for

HTTPS requests.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* RouteInfo and HttpRoute to include the target name from the URI authority in case it differs

from the target host (the host recognizes multiple authorities).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2316: BasicHttpClientConnectionManager incorrectly re-uses the released connection

if it has been closed out by the protocol handler.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2070: Auth cache to no longer rely on Java serialization for auth state caching.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-751: Support for RFC 2817 (Upgrading to TLS Within HTTP/1.1).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Connection endpoints to provide TLS details and protocol version.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Deprecated ConnectionSocketFactory, LayeredConnectionSocketFactory, and their plain and SSL

implementations in favor of DefaultClientTlsStrategy.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Standard client TLS strategy implementations support the upgrading of blocking sockets.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* FileResourceFactory to generate stable file names for the same request ID and entity tag.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Cache ResourceFactory to make use of strong eTags when available.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* ETag APIs.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Fixed a design mistake of ConnectionEndpoint having a direct dependency on

HttpRequestExecutor class.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Cache control and context APIs.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2315: Client builders fail to apply system properties to the default

connection manager.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2314: Handle gracefully a failure of DnsResolver to return a list of

resolved addresses (#533).

Contributed by Philip Helger <philip at helger.com>

* HTTPCLIENT-2314: Throw ConnectionShutdownException in case of pooled connection

having been closed or discarded instead of plain IllegalStateException.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.4 ALPHA1

-------------------

This is the first ALPHA release in the 5.4 release series that improves HTTP protocol support

by ensuring conformance to the latest HTTP specification (RFC 9110, RFC 9111, RFC 7616,

RFC 7617), ensures compatibility with Java Virtual Threads by replacing 'synchronized' keywords

in critical sections with Java lock primitives. The HTTP caching protocol layer has also been

redesigned and overhauled to improve cache efficiency and optimize performance.

Change Log

-------------------

* `username*` validation and decoding in DigestScheme as per RFC (#511).

Contributed by Arturo Bernal <abernal at apache.org>

* Support for Userhash parameter in Digest authentication as per RFC 7616 (#509).

Contributed by Arturo Bernal <abernal at apache.org>

* Enforce UTF-8 encoding in Digest authentication according to RFC 7616 (#508).

Contributed by Arturo Bernal <abernal at apache.org>

* Enforce UTF-8 encoding in BasicSchemeFactory as per RFC 7617 (#506).

Contributed by Arturo Bernal <abernal at apache.org>

* Stricter password validation in BasicScheme (#505).

Contributed by Arturo Bernal <abernal at apache.org>

* Bug fix: When validating a cache entry the protocol handlers must use the current request

message with additional headers generated by the previous request interceptors instead of

the original request message.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Better debug logging in the caching protocol handlers.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Better HTTP execution context management by caching protocol handlers.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2301. Fixed a concurrency defect in the connection release code of

BasicHttpClientConnectionManager.

Contributed by Arturo Bernal <abernal at apache.org>

* HttpCacheEntry to cache parsed DATE, EXPIRES, and LAST_MODIFIED values; avoid parsing

DATE header of cache entries and HTTP messages multiple times.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2293: Via header protocol improvements and performance optimization.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2293: RFC-compliant TRACE request interceptor (#486).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2293: 'If-Range' request validation as per RFC 9110 (#485).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2293: Enforce port specification for CONNECT requests as per RFC 9110 (#482).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2284: Internal cache storage improvements (#478).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Replace `synchronized` blocks with ReentrantLock to ensure compatibility with virtual

threads (#476).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2284: Cache entry representation improvements: (#477).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2277: Rewrite the caching protocol layer for improved efficiency and

conformance to RFC 9111.

Contributed by Arturo Bernal <[email protected]> and

Oleg Kalnichevski <olegk at apache.org> and

* Request and response Cache-Control APIs

Contributed by Arturo Bernal <[email protected]> and

Oleg Kalnichevski <olegk at apache.org> and

* HttpByteArrayCacheEntrySerializer refactoring and performance improvements.

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.3

-------------------

This is the first GA release in the 5.3 release series. This release finalizes the 5.3 APIs

and also includes all bug fixes from the 5.2 release branch.

The 5.3 release series introduces support for the Bearer authentication scheme (RFC 6750) and

deprecates NTLM and GSS-based experimental authentication schemes in favor of Basic / Bearer

authentication with TLS.

Notable changes and features included in the 5.3 series:

* Introduction of the Bearer authentication scheme.

* Deprecation of the NTLM authentication scheme.

* Deprecation of the GSS-based experimental authentication schemes.

* Support for load distribution across multiple proxies.

Change Log

-------------------

* HTTPCLIENT-2310: Async Connect exec handler incorrectly pipes CONNECT requests through the main

request protocol chain.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.2.4.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* SEE OTHER redirect handling fix.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2305: SSLConnectionSocketFactory allows Socket.connect() to be decorated (#499).

Contributed by Carter Kozak <ckozak at apache.org>

* Add security warning to TrustStrategy implementations documentation (#490).

Contributed by Marcono1234 <Marcono1234 at users.noreply.github.com>

* More consistent handling of OperationTimeoutException in MemcachedHttpCacheStorage.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Document exec chain behavior when automatic retries are enabled. (#480).

Contributed by cachescrubber <lars.uffmann at gmail.com>

* HTTPCLIENT-2291: Fixed inconsistency in behavior between the class and async implementation

of the request re-execution. The async request retry exec will now restart request execution

from itself instead of from the very beginning of the execution chain.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.3 ALPHA1

------------------

This is the first release in the 5.3 release series that introduces support for the Bearer

authentication scheme (RFC 6750) and deprecates NTLM and GSS-based experimental authentication

schemes in favor of Basic / Bearer authentication with TLS.

Change Log

-------------------

* GSS-based experimental authentication schemes deprecated and disabled by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* NTLM scheme deprecated and disabled by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Added linear and exponential BackoffManager implementations.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Improved AIMDBackoffManager.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Added DistributedProxySelector with support for load distribution across multiple

proxies.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Support for preamble and epilogue in multipart entities.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* HttpResponseException to include response message content (up to 256 bytes).

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Workaround for URL quoting issue with LLv6 host literals.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Bearer auth scheme support (RFC 6750)

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Credentials interface should be able to represent different types of user credentials

including token-based with no password.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Connection settings `timeToLive` and `validateAfterInactivity` set to zero to always

close or validate connections being leased.

Contributed by Christoph Kaser <berlin at caser.de>

* Digest authentication scheme to omit the algorithm in the authentication response

if it has not been explicitly set in the authentication challenge, as per RFC 7616.

Contributed by John Vasileff <john at vasileff.com>

* HTTPCLIENT-2271: Do not optimize the path component of the resolved URI by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Pass HttpContext to SSLConnectionSocketFactory#prepareSocket method (#404)

Contributed by Alen Turkovic <alturkovic at gmail.com>

Release 5.2.1

------------------

This is a maintenance release that fixes several regressions found in release 5.2.

Change Log

-------------------

* Regression: Async execution runtimes set the negotiated protocol version in the execution

context at the wrong point of request execution.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Cancel connection request on exception.

Contributed by Bryan Keller <bryanck at gmail.com>

* Replace deprecated use of LangUtils#equals() with Objects.equals().

Contributed by Gary Gregory <ggregory at apache.org>

* Regression: Multipart body builder and multipart formatters fail to escape special characters

such as backslash and quote mark.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.2

------------------

This is the first GA release in the 5.2 release series. This release finalizes the 5.2 APIs

and corrects several defects discovered since the previous release.

Please note that 5.2 upgrades the minimal JRE level to version 8 (8u251 is required).

Please note this is likely to be the last release series with support for SPNEGO and NTLM

authentication. As of version 5.3 GSS-API-based authentication schemes (Kerberos, SPNEGO)

and NTLM authentication schemes are going to be deprecated and disabled by default.

Notable changes and features included in the 5.2 series:

* Upgrade to Java 8.

* Improved support for TLS upgrade and HTTP protocol upgrade (async).

* Support for H2 tunneling via HTTP/1.1 proxy.

* Conformance to RFC 7617 (The 'Basic' HTTP Authentication Scheme).

* Migration to Java 8 Time primitives in State Management and Cache APIs.

* Connection and TLS configuration on a per-route basis.

* Base64 codec based on Commons Codec replaced with JRE Base64 codec.

Dependency on Commons Codec dropped.

* Optional support for BR (Brotli) decompression.

Change Log

-------------------

* HTTPCLIENT-2242: RoutingSupport fails to copy InetAddress when normalizing HttpHost.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2240: Fixed incorrect CONNECT method initialization in ProxyClient.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2236: MultihomeIOSessionRequester fails to enhance the cause exception in case

of connect failure if the remoteAddress argument has been given.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Use Objects.toString() instead of String type cast

Contributed by Gary Gregory <garydgregory at gmail.com>

* HTTPCLIENT-2232: Last protocol interceptors moved at the end of the H2 protocol processing

pipeline.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* H2 async runtime to proactively set HTTP/2 protocol version in the execution context.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2231: Fixed a race condition in the main async executor when the request execution

on an I/O thread is faster than execution pipeline management on the client thread.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Avoid duplicate redundant objects and use Singleton instead.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* HTTPCLIENT-2225: Connection route calculation does not take the default RequestConfig into

account.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Avoid unnecessary use of Instant.toEpochMilli by using Instant#compareTo to compare

Instants directly.

Contributed by jkmcl

* HTTPCLIENT-2221 Closing a classic response/entity allows connection reuse.

Contributed by Carter Kozak <ckozak at apache.org>

Release 5.2 BETA1

------------------

This is the first BETA release in the 5.2 release series that upgrades the minimal JRE

level to version 8 (8u251 is required) and includes several protocol level and

API improvements. It also includes all bug fixes from the 5.1 branch.

Change Log

-------------------

* Upgraded HttpCore to version 5.2-beta2.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2218: Use Java 8 Base64 utility (#370).

Contributed by j3graham <[email protected]>

* Added support for BR (Brotli) decompression (#363).

Contributed by 殷成涛 <[email protected]>

* HTTPCLIENT-2212: MinimalHttpAsyncClient fails to release client endpoints in case of

a connect error (such as TLS handshake failure).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* InternalAbstractHttpAsyncClient to create daemon threads.

Contributed by Richard Hernandez <riher at amazon.com>

* HTTPCLIENT-2080: Added #getRetryInterval method to HttpRequestRetryStrategy for use

on retriable IOExceptions (#356).

Contributed by Anthony Baldocchi <489445+ajbaldocchi at users.noreply.github.com>

* Fixed infinite recursion in SSLConnectionSocketFactory.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-2200: Protocol interceptors are executed before the connection route has

been fully established.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2209: Pass HttpContext to AsyncClientConnectionOperator (#353).

Contributed by Andriy Redko <drreta at gmail.com>

* HTTPCLIENT-2206: Corrected resource de-allocation by fluent response objects.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* ExecSupport#getNextExchangeId() optimization (#352)

Contributed by David Schlosnagle <schlosna at gmail.com>

* HTTPCLIENT-2203: Corrected target host normalization by the request execution interceptors;

added ContextBuilder with support for preemptive authentication initialization.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2202: MemcachedHttpCacheStorage to support MemcachedClientIF interface.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Bug fix: ByteArrayBuilder incorrectly handles empty strings.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2198: Fixed AbstractClientTlsStrategy to respect HttpVersionPolicy.

Contributed by Andrei Vasilev <59628447+AndreiSVasilev at users.noreply.github.com>

* Updated AbstractClientTlsStrategy to pass only the HttpVersionPolicy set by TlsConfig

instead of the entire TlsConfig to H2TlsSupport#selectApplicationProtocols() method.

Contributed by Andrei Vasilev <59628447+AndreiSVasilev at users.noreply.github.com>

* HTTPCLIENT-2195, regression: Classic ConnectExec incorrectly discards the proxy response

body even if the request cannot be executed and the response is final.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2194: Async retry request interceptor fails to correct include request body

on retry (#343).

Contributed by JasonMathison <JasonMathison at users.noreply.github.com>

* Deprecated execute methods that return an open response object in favor of execute

methods with a response handler and automatic resource deallocation.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2189: Cookie and Cache APIs to use Java time primitives.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Apply English locale to all date header formatters.

Contributed by Michael Osipov <michaelo at apache.org>

* HTTPCLIENT-2184: Fixed an issue in which connections were not returned to the pool

when requests contained non-repeatable bodies AND responses were streamed.

Contributed by Carter Kozak <ckozak at apache.org>

Release 5.2 ALPHA1

------------------

This is the first ALPHA release in the 5.2 release series that upgrades minimal JRE

level to version 1.8 (8u251 is required) and includes several protocol level and

API improvements. It also includes all bug fixes from the 5.1 branch.

Notable changes and features included in the 5.2 series:

* Upgrade to Java 8.

* Improved support for TLS upgrade and HTTP protocol upgrade (async).

* Support for H2 tunneling via HTTP/1.1 proxy.

* Conformance to RFC 7617 (The 'Basic' HTTP Authentication Scheme).

Change Log

-------------------

* Replaced SimpleDateFormat and Calendar with Java 8 Time APIs; removed thread-local

from DateUtils.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Support for connection 'total time to live' setting on a per-route basis.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Configurable IOReactor IO session decorator configurable.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* HTTPCLIENT-2182: Access to SSLSession attributes via reflection is disallowed as of Java 16.

Core TLS functions now use new Java 1.8 API introduced by 8u251 update.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2135: TLS configuration on a per-host basis.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* RFC 7230: Treat presence of userinfo in authority component in request URI as an HTTP

protocol violation.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* AuthCache conformance to RFC 7617.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Added immutable CredentialsProvider implementations and a CredentialsProvider builder.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2045: BASIC auth scheme conformance to RFC 7617.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2120: support for H2 via HTTP/1.1 proxy.

Contributed by Oleg Kalnichevski <olegk at apache.org>