elasticsearch-rest-client is using an old non-maintained version of httpasyncclient-4.1.4.jar

[oridool]

When I use latest rest client, it brings with it a dependency of an old async http client (httpasyncclient-4.1.4.jar).
This client is no longer maintained. See its github page: https://github.com/apache/httpasyncclient

Not only this is a security risk, I also believe that using this old client causes multiple issues, and also related to :
spring-projects/spring-data-elasticsearch#1387
spring-projects/spring-data-elasticsearch#1948

The expected solution:
elasticsearch-rest-client should use the latest modern http client 5.x, which has the same functionality.
https://github.com/apache/httpcomponents-client

[kanumalivad]

Kindly assign to me, This will be my first open source contribution

[booleanhunter]

@oridool Is this issue still being worked on? If not, may I take this up?

[kanumalivad]

@booleanhunter You can take this.

[brokemyspoke]

Hi @dblock, I'm looking for an issue to start contributing here.

I was checking this one out since im building out the project but it appears to have been addressed: (Move to core 5.x) #4459. Aside from some unused references in version.properties and an old .classpath file, I believe this could be closed.

I'll keep looking for an issue. ;)

[dblock]

Aside from some unused references in version.properties and an old .classpath file, I believe this could be closed.

Are you saying we still have those? Let's remove them before closing? Please do!

[reta]

@dblock we use 4.x clients in 2.x branches whereas httpasyncclient latest release is 4.1.5:

httpclient        = 4.5.13
httpcore          = 4.4.15
httpasyncclient   = 4.1.5