Release 5.7 ALPHA1

------------------

This is the first ALPHA release in the 5.7 release series. It introduces several new

modules with Server-Sent Events (SSE) client, WebSocket client and Jakarta REST client

implementations that build upon the common foundation of the core and client modules.

Please note the Jakarta REST client presently supports a sub-set of jakarta.ws.rs APIs

only. This release series also introduces full support for QUERY method including QUERY

response caching.

Notable changes and features included in the 5.7 series:

* [Experimental] Server-Sent Events (SSE) client optimized to handle push event streams.

* [Experimental] WebSocket protocol support (client and server side).

* [Experimental] Optional execution queue that enforces a max limit on the number of requests

executed concurrently by the same async client instance.

* Caffeine-based cache backend.

* OFFLOCK pool concurrency policy for connection pools (classic and async).

* TLS-Required mode support.

* Jakarta REST client, supporting a sub-set of jakarta.ws.rs APIs.

* QUERY method support / QUERY response caching support.

Compatibility notes:

* Client and connection pool builders no longer make direct use of `http(s).protocols`,

`http(s).proxyUser`, `http(s).proxyPassword`, `http.agent`, `http.keepAlive` and

`http.auth.ntlm.domain`system properties. Please note some of those properties may still

be used by Authenticator#requestPasswordAuthentication internally.

* Connection pool builders now respect JSSE system properties by default.

* Standard async HttpClient now uses message exchange multiplexing over active HTTP/2

connections by default.

* IMPORTANT: This is likely the last release series with the Fluent Facade APIs. Users

of the Fluent Facade are recommended to migrate to Jakarta REST client. Fluent Facade

APIs should be considered deprecated and its support will be discontinued in

the 5.8 release.

Change Log

----------

* Enable multiplex message exchanges over active HTTP/2 connections by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Reject control characters in Bearer tokens used by the BearerScheme.

Contributed by Javid Khan <dxbjavid at gmail.com>

* Extended HttpCacheEntry and related classes to store the enclosed request body

(#859).

Contributed by hunghhdev <hunghh.dev at gmail.com>

* HTTPCLIENT-2428: Scale reactor capacity in inflating AsyncDataConsumers to match

decompressed output.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTP cache support for the QUERY method (RFC 10008) (#852)

Contributed by hunghhdev <hunghh.dev at gmail.com>

* Do not store a response when the request specifies `no-store` in Cache-Control.

Contributed by Arturo Bernal <abernal at apache.org>

* CacheKeyGenerator to support requests with an enclosed content body such as QUERY.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Include the URI scheme component in redirect same-authority check.

Contributed by Javid Khan <dxbjavid at gmail.com>

* Escape quotes and strip line breaks in RFC 7578 multipart parameters.

Contributed by Javid Khan <dxbjavid at gmail.com>

* Support for HTTP QUERY method (#840).

Contributed by Mario Daniel Ruiz Saavedra <desiderantes93 at gmail.com>

* HTTPCLIENT-2423: Propagate trace context in observation interceptors.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-1165: Support for optional async cache request collapsing. Experimental.

Contributed by Arturo Bernal <abernal at apache.org>

* Parsing code optimization in DateUtils.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Parsing code optimization in ETag.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2421: Use effective retry interval for response timeout check.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2398: Optional execution queue that enforces a max limit on the number of

requests executed concurrently by the same async client instance.

Contributed by Arturo Bernal <abernal at apache.org>

* Jakarta REST client (partial jakarta.ws.rs API support).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2418: Use UTF-8 as the default charset handling in SimpleBody for JSON

content.

Contributed by Arturo Bernal <abernal at apache.org>

* H2 streams initiated by the standard async client can be gracefully cancelled

or time out without closing the underlying connection.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Improved RFC 9111 cache control compliance.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-973: WebSocket protocol support.

Contributed by Arturo Bernal <abernal at apache.org>

* Connection managers to unwrap DeadlineTimeoutException from ExecutionException

and propagate it to the caller.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* BasicCookieStore to preserve creation time on cookie replacement as per RFC 6265

section 5.3 and section 5.4.

Contributed by Arturo Bernal <abernal at apache.org>

* Treat Cache-Control `max-age` <= 0 as immediate expiry (#805).

Contributed by Arturo Bernal <abernal at apache.org>

* Treat Cache-Control `max-stale` without a value (accept any staleness) as

unbounded value (#804).

Contributed by Arturo Bernal <abernal at apache.org>

* Pool lease metrics and helpers for connection managers (#799).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2381: Respect JSSE system properties by default.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* Pluggable ExchangeId generator support.

Contributed by yhzdys <yhzdys at foxmail>

* Discontinue the use of `http(s).protocols` system properties.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Discontinue the direct use of `http(s).proxyUser` and `http(s).proxyPassword` system

properties.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Discontinue the use of `http.agent`, `http.keepAlive` and `http.auth.ntlm.domain`

system properties.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2397: Support for TLS-Required mode (#777).

Contributed by Arturo Bernal <abernal at apache.org>

* Support for pluggable connection pool event listeners.

Contributed by Florian Tavares <Florian.Tavares at boursorama.fr>

* OFFLOCK pool concurrency policy backed by RouteSegmentedConnPool (#765).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2396: Server-Sent Events client.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2406: MemcachedHttpCacheStorage to support per entry expiry setting.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Caffeine-based cache backend (#756).

Contributed by Arturo Bernal <abernal at apache.org>

* Removed AccessController#doPrivileged method calls.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.6 ALPHA1

------------------

This is the first ALPHA release in the 5.6 release series. It adds several features

such as transport content decompression and content compression for the async transport,

support for Unix sockets, experimental support for SCRAM-SHA-256 authentication scheme,

and Micrometer/OTel observations & metrics.

Commons Compress, Brotli codec, and ZStd codec are optional dependencies and get

wired into the execution pipeline only if present on the classpath.

Notable changes and features included in the 5.6 series:

* Unix domain socket support.

* Support for pluggable content codecs via Commons-Compress in the classic transport.

(optional).

* Support for transparent content decompression and content compression with `deflate`,

`gzip`, `zstd` (optional), and `brotli` (optional) codecs in the async transport.

* Micrometer/OTel observations & metrics (optinal).

* Off-lock connection disposal by the classic pooling connection manager. Experimental.

* SCRAM-SHA-256 authentication scheme (RFC 7804). Experimental.

* Request Priority support (RFC 9218). Experimental.

Compatibility notes:

* As of this version, HttpClient uses BUILTIN HostnameVerificationPolicy by default, delegating

host verification to JSSE security manager. One must explicitly configure the TLS strategy

to continue using the hostname verifier shipped with HttpClient.

* Five-second TCP keep-alive is now enabled by default.

Change Log

-------------------

* RequestConfig: Un-deprecate #setProxy.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* Stale connection check support in PoolingAsyncClientConnectionManager.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* ConnectionConfig: `#idleTimeout` support.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `brotli` codec (#720).

Contributed by Arturo Bernal <abernal at apache.org>

* SCRAM-SHA-256 authentication scheme (RFC 7804) (#718).

Contributed by Arturo Bernal <abernal at apache.org>

* Off-lock connection disposal in PoolingHttpClientConnectionManager (#726).

Contributed by Arturo Bernal <abernal at apache.org>

* Add SPKI pinning TLS decorator (#715).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2387: Micrometer/OTel observations & metrics (#706).

Contributed by Arturo Bernal <abernal at apache.org>

* Clarification of the behavior of the protocol level `responseTimeout` and the connection

management level `socketTimeout` and their interrelation.

Contributed by ChangYong <lcy9002 at naver.com>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `zstd` codec (#703).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `gzip` codec (#700).

Contributed by Arturo Bernal <abernal at apache.org>

* Enable new TcpKeepAlive options on Java 8.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* Unsupported content encoding to be treated as an error.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-1822: Support for async transparent content decompression and content

compression with `deflate` codec.

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2385: Default managed connection implementations now have public constructors

marked as internal (#692).

Contributed by winfriedgerlach <158032591+winfriedgerlach at users.noreply.github.com>

* HTTPCLIENT-2383: Bypass sensitive-header check in LaxRedirectStrategy (#676).

Contributed by Arturo Bernal <abernal at apache.org>

* Enable JEP 380 UDS support for sync client.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-2375 Support for pluggable Commons-Compress encoders (#657).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-1843: Support for pluggable Commons-Compress decoders (#651).

Contributed by Arturo Bernal <abernal at apache.org>

* Switched HostnameVerificationPolicy to BUILTIN by default

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Omit cookie spec registry when cookie management is disabled.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* java.nio.file.Body-based MIME body (#641).

Contributed by Gary Gregory <garydgregory at gmail.com>

* Unix domain socket support.

Contributed by Ryan Schmitt <rschmitt at apache.org>

Release 5.5

------------------

This is the first GA release in the 5.5 release series. This release finalizes the 5.5

APIs and adds several experimental features and improvements, such as request multiplexing

over a shared HTTP/2 connection and the Classic API facade acting as a compatibility

bridge between classic I/O client services and the asynchronous message transport used

internally.

Notable changes and features included in the 5.5 series:

* Improved conformance to RFC 7616 (HTTP Digest Access Authentication).

* The connection pool implementation acts as a caching facade in front of a standard

managed connection pool and shares already leased connections to multiplex message

exchanges over active HTTP/2 connections. Experimental.

* Extended Auth API and improved authentication protocol logic to support mutual

authentication.

* The Classic API facade now acts as a compatibility bridge between the classic I/O client

services (based on the standard InputStream / OutputStream model) and the asynchronous

message transport used internally. This is experimental.

* HTTP/2 support for the Fluent Facade (via Classic API facade). This is experimental.

Compatibility notes:

* As of this release, HttpClient does not automatically execute redirects if the original

request manually added headers that are considered sensitive.

Change Log

-------------------

* HTTPCLIENT-2367: Fixed NPE in InternalAbstractHttpAsyncClient by adding a null check for

resolvedTarget (#634).

Contributed by Arturo Bernal <abernal at apache.org>

* Fixed case of Cookie#HTTP_ONLY_ATTR

Contributed by Finn Petersen <fp7@posteo.net>

* Simplified ProtocolSwitchStrategy by leveraging ProtocolVersionParser (#627).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2364: Fixed incorrect re-binding of the upgraded SSL socket to the HTTP

connection by the #upgrade method of the DefaultHttpClientConnectionOperator.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2363: ensure requests have a scheme and an authority populated before

they get committed to the execution pipeline.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.3.4

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Disallow automatic request redirection if the original request contains potentially

sensitive headers.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2360: Enhance filename encoding in multipart/form-data per RFC 6266/5987

(#618).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Corrected APIs in ClientTlsStrategyBuilder to be compatible with Classic APIs.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Bump testcontainers.version from 1.20.4 to 1.20.6 #622.

Contributed by Gary Gregory <garydgregory at gmail.com>

* Bump org.junit:junit-bom from 5.11.4 to 5.12.2 #623, #632.

Contributed by Gary Gregory <garydgregory at gmail.com>

* Bump log4j.version from 2.23.1 to 2.24.3 #626.

Contributed by Gary Gregory <garydgregory at gmail.com>

Release 5.5 ALPHA1

------------------

This is the first ALPHA release in the 5.5 release series. It adds several experimental

features and improvements such as request multiplexing over a shared HTTP/2 connection

and the Classic API facade acting as a compatibility bridge between classic I/O client

services and the asynchronous message transport used internally.

Notable changes and features included in the 5.5 series:

* Improved conformance to RFC 7616 (HTTP Digest Access Authentication).

* The connection pool implementation acts as a caching facade in front of a standard

managed connection pool and shares already leased connections to multiplex message

exchanges over active HTTP/2 connections. Experimental.

* Extended Auth API and improved authentication protocol logic to support mutual

authentication.

* The Classic API facade acting as a compatibility bridge between the classic I/O client

services (based on the standard InputStream / OutputStream model) and the asynchronous

message transport used internally. Experimental.

* HTTP/2 support for the Fluent Facade (via Classic API facade). Experimental.

Change Log

-------------------

* Async transport can now be used internally by the Fluent Facade.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Classic over async bridge.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2356: Extended Auth APIs and authentication protocol logic to support mutual

authentication.

Contributed by Istvan Toth <stoty at apache.org>

* Decode Subject Alternative Names for IP, DNS, and binary data (#610).

Contributed by Arturo Bernal <abernal at apache.org>

* Do not add `Upgrade` header if `Connection` header is already present (the caller manually

manages connection state).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Avoid logging the HTTP message version where it can be a hint, not a protocol version.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Experimental connections pool implementation that acts as a caching facade in front of

a standard ManagedConnPool and shares already leased connections to multiplex message

exchanges over active HTTP/2 connections.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2350 - Refactored the connect method in DefaultHttpClientConnectionOperator

to enhance flexibility in address resolution, specifically allowing for direct handling

of unresolved addresses (#598).

Contributed by Arturo Bernal <abernal at apache.org>

* Enhanced DigestScheme for RFC 7616 Compliance and Expanded Hash Algorithm Support (#597).

Contributed by Arturo Bernal <abernal at apache.org>

* Added request interceptor to check the `Authentication-Info` header in HTTP Digest Access

Authentication (#596).

Contributed by Arturo Bernal <abernal at apache.org>

* Added client-side `rspauth` value for Digest auth, verifying server knowledge of shared

secret per RFC 7616. (#594).

Contributed by Arturo Bernal <abernal at apache.org>

* Corrected method chaining in ClientTlsStrategyBuilder.

Contributed by Osip Fatkullin <osip.fatkullin at gmail.com>

* HTTPCLIENT-2337: Sanitize X500Principal Logging in ClientTlsStrategy classes (#581).

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.4

------------------

This is the first GA release in the 5.4 release series. This release finalizes the 5.4 APIs,

upgrades HttpCore to version 5.3 and improves the Public Suffix matching algorithm implementation.

IMPORTANT! The new cache entry serialization format is incompatible with earlier

versions of HttpClient Cache. Persistent caches (file system based, Memcached, EhCAche

with object serialization) created with any earlier version MUST be flushed and re-populated

or the cache backend MUST be configured to use the old, deprecated cache entry serializer.

Notable changes and features included in the 5.4 series:

* Improved conformance to RFC 9110 (HTTP Semantics), RFC 7616 (HTTP Digest Access

Authentication), RFC 2617 (’Basic’ HTTP Authentication Scheme).

* UTF-8 encoding is used by default for text where appropriate.

* Compatibility with Java Virtual Threads and Java 21 Runtime.

* Redesign and rewrite of the HTTP caching protocol layer for better efficiency

and improved conformance to RFC 9111 (HTTP Caching).

* Cache control and context APIs.

* ETag APIs.

* TLS SNI and endpoint identification improvements.

* Support for RFC 2817 (Upgrading to TLS Within HTTP/1.1).

* Auth cache no longer makes use of Java serialization.

* Deprecation of ConnectionSocketFactory and LayeredConnectionSocketFactory.

* HttpContext optimization and performance improvement.

* Async cache is no longer considered experimental.

Change Log

-------------------

* HTTPCLIENT-2338: Put compress exec interceptor after retry exec interceptor.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.3.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Javadoc improvements.

Contributed by Gary Gregory <garydgregory at gmail.com>

* DeflateInputStream extends FilterInputStream

Contributed by Gary Gregory <garydgregory at gmail.com>

* HTTPCLIENT-2335: Added close() method with CloseMode parameter to CloseableHttpResponse.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2336: Corrected hostname identity verification logic.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2336: Updated PublicSuffixMatcher to use the 'formal algorithm' as specified

https://github.com/publicsuffix/list/wiki/Format#formal-algorithm.

Contributed by Adrian Woodhead <adrian.woodhead at humansecurity.com>

* Input streams returned by DecompressingEntity#getContent to support mark(int) and reset()

if the underlying stream does.

Contributed by Gary Gregory <garydgregory at gmail.com>

* Improved FQDN matching.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Removed @Experimental from async cache classes.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2333: Update execution scope upon request redirect to avoid re-execution

of the original request in case of an I/O error.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Re-introduced LaxRedirectStrategy from 4.x

Contributed by Otavio Prado <otavio.prado at sensedia.com>

Release 5.4 BETA1

------------------

This is the first BETA release in the 5.4 release series. It upgrades HttpCore to version

5.3-beta1 and adds a few minor improvements and fixes.

Change Log

-------------------

* HTTPCLIENT-2328: Blocking I/O connections to check if the opposite TLS endpoint

has been closed by the opposite endpoint while writing out request body.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Redesign of test server APIs and integration test setup.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2331: Skip cookie header generation if a Cookie header is already

present (#561).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2326: Propagate original proxy response to the caller in case of

HTTP CONNECT request failure.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2327: Propagate CancellationExceptions from MemcachedClient operations

as ResourceIOExceptions (#559).

Contributed by jattisha <jattisha at umich.edu>

* Callbacks for Connection initialization.

Contributed by Richard Tippl <richard.tippl at gmail.com>

* HTTPCLIENT-2325 Avoid adding "; charset=" for multipart/form-data requests

Contributed by Vladimir Sitnikov <sitnikov.vladimir at gmail.com>

Release 5.4 ALPHA2

------------------

This is the second and likely the last ALPHA release in the 5.3 release series.

It finalizes the new Cache API introduced in the previous ALPHA release and also

improves TLS customization for the classic transport, SNI and endpoint identification

support, authentication data caching, and HTTP context performance. It also introduces

support for optional TLS upgrades for HTTP/1.1 connections.

Change Log

-------------------

* HttpClientContext to use instance variables for standard attributes.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2151: Support for JSSE in-built endpoint identification.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Internal connection operators to make use of the target name from the request URI

authority.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* DefaultRoutePlanner to take the request authority into account when determining a route for

HTTPS requests.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* RouteInfo and HttpRoute to include the target name from the URI authority in case it differs

from the target host (the host recognizes multiple authorities).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2316: BasicHttpClientConnectionManager incorrectly re-uses the released connection

if it has been closed out by the protocol handler.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2070: Auth cache to no longer rely on Java serialization for auth state caching.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-751: Support for RFC 2817 (Upgrading to TLS Within HTTP/1.1).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Connection endpoints to provide TLS details and protocol version.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Deprecated ConnectionSocketFactory, LayeredConnectionSocketFactory, and their plain and SSL

implementations in favor of DefaultClientTlsStrategy.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Standard client TLS strategy implementations support the upgrading of blocking sockets.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* FileResourceFactory to generate stable file names for the same request ID and entity tag.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Cache ResourceFactory to make use of strong eTags when available.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* ETag APIs.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Fixed a design mistake of ConnectionEndpoint having a direct dependency on

HttpRequestExecutor class.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Cache control and context APIs.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2315: Client builders fail to apply system properties to the default

connection manager.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2314: Handle gracefully a failure of DnsResolver to return a list of

resolved addresses (#533).

Contributed by Philip Helger <philip at helger.com>

* HTTPCLIENT-2314: Throw ConnectionShutdownException in case of pooled connection

having been closed or discarded instead of plain IllegalStateException.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.4 ALPHA1

-------------------

This is the first ALPHA release in the 5.4 release series that improves HTTP protocol support

by ensuring conformance to the latest HTTP specification (RFC 9110, RFC 9111, RFC 7616,

RFC 7617), ensures compatibility with Java Virtual Threads by replacing 'synchronized' keywords

in critical sections with Java lock primitives. The HTTP caching protocol layer has also been

redesigned and overhauled to improve cache efficiency and optimize performance.

Change Log

-------------------

* `username*` validation and decoding in DigestScheme as per RFC (#511).

Contributed by Arturo Bernal <abernal at apache.org>

* Support for Userhash parameter in Digest authentication as per RFC 7616 (#509).

Contributed by Arturo Bernal <abernal at apache.org>

* Enforce UTF-8 encoding in Digest authentication according to RFC 7616 (#508).

Contributed by Arturo Bernal <abernal at apache.org>

* Enforce UTF-8 encoding in BasicSchemeFactory as per RFC 7617 (#506).

Contributed by Arturo Bernal <abernal at apache.org>

* Stricter password validation in BasicScheme (#505).

Contributed by Arturo Bernal <abernal at apache.org>

* Bug fix: When validating a cache entry the protocol handlers must use the current request

message with additional headers generated by the previous request interceptors instead of

the original request message.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Better debug logging in the caching protocol handlers.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Better HTTP execution context management by caching protocol handlers.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2301. Fixed a concurrency defect in the connection release code of

BasicHttpClientConnectionManager.

Contributed by Arturo Bernal <abernal at apache.org>

* HttpCacheEntry to cache parsed DATE, EXPIRES, and LAST_MODIFIED values; avoid parsing

DATE header of cache entries and HTTP messages multiple times.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2293: Via header protocol improvements and performance optimization.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2293: RFC-compliant TRACE request interceptor (#486).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2293: 'If-Range' request validation as per RFC 9110 (#485).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2293: Enforce port specification for CONNECT requests as per RFC 9110 (#482).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2284: Internal cache storage improvements (#478).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Replace `synchronized` blocks with ReentrantLock to ensure compatibility with virtual

threads (#476).

Contributed by Arturo Bernal <abernal at apache.org>

* HTTPCLIENT-2284: Cache entry representation improvements: (#477).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2277: Rewrite the caching protocol layer for improved efficiency and

conformance to RFC 9111.

Contributed by Arturo Bernal <arturobernalg@gmail.com> and

Oleg Kalnichevski <olegk at apache.org> and

* Request and response Cache-Control APIs

Contributed by Arturo Bernal <arturobernalg@gmail.com> and

Oleg Kalnichevski <olegk at apache.org> and

* HttpByteArrayCacheEntrySerializer refactoring and performance improvements.

Contributed by Arturo Bernal <abernal at apache.org>

Release 5.3

-------------------

This is the first GA release in the 5.3 release series. This release finalizes the 5.3 APIs

and also includes all bug fixes from the 5.2 release branch.

The 5.3 release series introduces support for the Bearer authentication scheme (RFC 6750) and

deprecates NTLM and GSS-based experimental authentication schemes in favor of Basic / Bearer

authentication with TLS.

Notable changes and features included in the 5.3 series:

* Introduction of the Bearer authentication scheme.

* Deprecation of the NTLM authentication scheme.

* Deprecation of the GSS-based experimental authentication schemes.

* Support for load distribution across multiple proxies.

Change Log

-------------------

* HTTPCLIENT-2310: Async Connect exec handler incorrectly pipes CONNECT requests through the main

request protocol chain.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Upgraded HttpCore to version 5.2.4.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* SEE OTHER redirect handling fix.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2305: SSLConnectionSocketFactory allows Socket.connect() to be decorated (#499).

Contributed by Carter Kozak <ckozak at apache.org>

* Add security warning to TrustStrategy implementations documentation (#490).

Contributed by Marcono1234 <Marcono1234 at users.noreply.github.com>

* More consistent handling of OperationTimeoutException in MemcachedHttpCacheStorage.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Document exec chain behavior when automatic retries are enabled. (#480).

Contributed by cachescrubber <lars.uffmann at gmail.com>

* HTTPCLIENT-2291: Fixed inconsistency in behavior between the class and async implementation

of the request re-execution. The async request retry exec will now restart request execution

from itself instead of from the very beginning of the execution chain.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.3 ALPHA1

------------------

This is the first release in the 5.3 release series that introduces support for the Bearer

authentication scheme (RFC 6750) and deprecates NTLM and GSS-based experimental authentication

schemes in favor of Basic / Bearer authentication with TLS.

Change Log

-------------------

* GSS-based experimental authentication schemes deprecated and disabled by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* NTLM scheme deprecated and disabled by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Added linear and exponential BackoffManager implementations.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Improved AIMDBackoffManager.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Added DistributedProxySelector with support for load distribution across multiple

proxies.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Support for preamble and epilogue in multipart entities.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* HttpResponseException to include response message content (up to 256 bytes).

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Workaround for URL quoting issue with LLv6 host literals.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* Bearer auth scheme support (RFC 6750)

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Credentials interface should be able to represent different types of user credentials

including token-based with no password.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Connection settings `timeToLive` and `validateAfterInactivity` set to zero to always

close or validate connections being leased.

Contributed by Christoph Kaser <berlin at caser.de>

* Digest authentication scheme to omit the algorithm in the authentication response

if it has not been explicitly set in the authentication challenge, as per RFC 7616.

Contributed by John Vasileff <john at vasileff.com>

* HTTPCLIENT-2271: Do not optimize the path component of the resolved URI by default.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Pass HttpContext to SSLConnectionSocketFactory#prepareSocket method (#404)

Contributed by Alen Turkovic <alturkovic at gmail.com>

Release 5.2.1

------------------

This is a maintenance release that fixes several regressions found in release 5.2.

Change Log

-------------------

* Regression: Async execution runtimes set the negotiated protocol version in the execution

context at the wrong point of request execution.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Cancel connection request on exception.

Contributed by Bryan Keller <bryanck at gmail.com>

* Replace deprecated use of LangUtils#equals() with Objects.equals().

Contributed by Gary Gregory <ggregory at apache.org>

* Regression: Multipart body builder and multipart formatters fail to escape special characters

such as backslash and quote mark.

Contributed by Oleg Kalnichevski <olegk at apache.org>

Release 5.2

------------------

This is the first GA release in the 5.2 release series. This release finalizes the 5.2 APIs

and corrects several defects discovered since the previous release.

Please note that 5.2 upgrades the minimal JRE level to version 8 (8u251 is required).

Please note this is likely to be the last release series with support for SPNEGO and NTLM

authentication. As of version 5.3 GSS-API-based authentication schemes (Kerberos, SPNEGO)

and NTLM authentication schemes are going to be deprecated and disabled by default.

Notable changes and features included in the 5.2 series:

* Upgrade to Java 8.

* Improved support for TLS upgrade and HTTP protocol upgrade (async).

* Support for H2 tunneling via HTTP/1.1 proxy.

* Conformance to RFC 7617 (The 'Basic' HTTP Authentication Scheme).

* Migration to Java 8 Time primitives in State Management and Cache APIs.

* Connection and TLS configuration on a per-route basis.

* Base64 codec based on Commons Codec replaced with JRE Base64 codec.

Dependency on Commons Codec dropped.

* Optional support for BR (Brotli) decompression.

Change Log

-------------------

* HTTPCLIENT-2242: RoutingSupport fails to copy InetAddress when normalizing HttpHost.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2240: Fixed incorrect CONNECT method initialization in ProxyClient.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2236: MultihomeIOSessionRequester fails to enhance the cause exception in case

of connect failure if the remoteAddress argument has been given.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Use Objects.toString() instead of String type cast

Contributed by Gary Gregory <garydgregory at gmail.com>

* HTTPCLIENT-2232: Last protocol interceptors moved at the end of the H2 protocol processing

pipeline.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* H2 async runtime to proactively set HTTP/2 protocol version in the execution context.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2231: Fixed a race condition in the main async executor when the request execution

on an I/O thread is faster than execution pipeline management on the client thread.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Avoid duplicate redundant objects and use Singleton instead.

Contributed by Arturo Bernal <arturobernalg at gmail.com>

* HTTPCLIENT-2225: Connection route calculation does not take the default RequestConfig into

account.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Avoid unnecessary use of Instant.toEpochMilli by using Instant#compareTo to compare

Instants directly.

Contributed by jkmcl

* HTTPCLIENT-2221 Closing a classic response/entity allows connection reuse.

Contributed by Carter Kozak <ckozak at apache.org>

Release 5.2 BETA1

------------------

This is the first BETA release in the 5.2 release series that upgrades the minimal JRE

level to version 8 (8u251 is required) and includes several protocol level and

API improvements. It also includes all bug fixes from the 5.1 branch.

Change Log

-------------------

* Upgraded HttpCore to version 5.2-beta2.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2218: Use Java 8 Base64 utility (#370).

Contributed by j3graham <j3graham@gmail.com>

* Added support for BR (Brotli) decompression (#363).

Contributed by 殷成涛 <yinwoods@163.com>

* HTTPCLIENT-2212: MinimalHttpAsyncClient fails to release client endpoints in case of

a connect error (such as TLS handshake failure).

Contributed by Oleg Kalnichevski <olegk at apache.org>

* InternalAbstractHttpAsyncClient to create daemon threads.

Contributed by Richard Hernandez <riher at amazon.com>

* HTTPCLIENT-2080: Added #getRetryInterval method to HttpRequestRetryStrategy for use

on retriable IOExceptions (#356).

Contributed by Anthony Baldocchi <489445+ajbaldocchi at users.noreply.github.com>

* Fixed infinite recursion in SSLConnectionSocketFactory.

Contributed by Ryan Schmitt <rschmitt at apache.org>

* HTTPCLIENT-2200: Protocol interceptors are executed before the connection route has

been fully established.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2209: Pass HttpContext to AsyncClientConnectionOperator (#353).

Contributed by Andriy Redko <drreta at gmail.com>

* HTTPCLIENT-2206: Corrected resource de-allocation by fluent response objects.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* ExecSupport#getNextExchangeId() optimization (#352)

Contributed by David Schlosnagle <schlosna at gmail.com>

* HTTPCLIENT-2203: Corrected target host normalization by the request execution interceptors;

added ContextBuilder with support for preemptive authentication initialization.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* HTTPCLIENT-2202: MemcachedHttpCacheStorage to support MemcachedClientIF interface.

Contributed by Oleg Kalnichevski <olegk at apache.org>

* Bug fix: ByteArrayBuilder incorrectly handles empty strings.