httpcore 4.5.14 is having high CVEs

[plaktoz]

It is currently having the following CVE:
https://nvd.nist.gov/vuln/detail/CVE-2026-54428
https://nvd.nist.gov/vuln/detail/CVE-2026-54399

When is the target date to move to a non-cve version for example
https://mvnrepository.com/artifact/org.apache.httpcomponents.core5/httpcore5/5.4.3

[rbri]

Fair point... but have a look at https://www.htmlunit.org/ - there is a sponsoring section at the top.

Doing this update is a bunch of work (as far as i can see)

• nobody seems to be willing to sponsor this
• i'm really busy with a bunch of other fixes
• i'm really busy doing some rhino/core-js stuff to move forward on the js side

#776

If this is important for your business, think about sponsoring; if this is important for your private/oss projects think about pull requests....