opensearch-project/OpenSearch

elasticsearch-rest-client is using an old non-maintained version of httpasyncclient-4.1.4.jar

Open

#1,308 opened on Sep 28, 2021

View on GitHub
 (6 comments) (0 reactions) (0 assignees)Java (1,505 forks)batch import
Clientsenhancementgood first issuehelp wanted

Repository metrics

Stars
 (8,123 stars)
PR merge metrics
 (Avg merge 5d 9h) (266 merged PRs in 30d)

Description

When I use latest rest client, it brings with it a dependency of an old async http client (httpasyncclient-4.1.4.jar). This client is no longer maintained. See its github page: https://github.com/apache/httpasyncclient

Not only this is a security risk, I also believe that using this old client causes multiple issues, and also related to : https://github.com/spring-projects/spring-data-elasticsearch/issues/1387 https://github.com/spring-projects/spring-data-elasticsearch/issues/1948

The expected solution: elasticsearch-rest-client should use the latest modern http client 5.x, which has the same functionality. https://github.com/apache/httpcomponents-client

Contributor guide

Research direction
Identify the dependency declaration for httpasyncclient in the build files (e.g., build.gradle, pom.xml) and replace it with the equivalent httpclient5 dependency. Also update any import statements and ensure backward compatibility.
Tech stack
java
Domain
backendapi
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Java
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75