When will we upgrade the dependency 'HttpClient' to version 5?

[jerome-cui]

I am using your latest version of Twilio sdk, which the version is 10.5.1. In this version the sdk still depends on apache httpclient with version 4.5.13. However there is a serious problem that it may cause virtual thread pinning problem in Java 21. The latest version of httpclient which is 5 has resolved the issue. So I want to know if there is a plan to upgrade it.

Thread[#113,ForkJoinPool-1-worker-34,5,CarrierThreads] java.base/java.lang.VirtualThread$VThreadContinuation.onPinned(VirtualThread.java:183) java.base/jdk.internal.vm.Continuation.onPinned0(Continuation.java:393) java.base/java.lang.VirtualThread.parkNanos(VirtualThread.java:621) java.base/java.lang.System$2.parkVirtualThread(System.java:2652) java.base/jdk.internal.misc.VirtualThreads.park(VirtualThreads.java:67) java.base/java.util.concurrent.locks.LockSupport.parkNanos(LockSupport.java:408) java.base/sun.nio.ch.Poller.pollIndirect(Poller.java:137) java.base/sun.nio.ch.Poller.poll(Poller.java:102) java.base/sun.nio.ch.Poller.poll(Poller.java:87) java.base/sun.nio.ch.NioSocketImpl.park(NioSocketImpl.java:175) java.base/sun.nio.ch.NioSocketImpl.timedRead(NioSocketImpl.java:280) java.base/sun.nio.ch.NioSocketImpl.implRead(NioSocketImpl.java:304) java.base/sun.nio.ch.NioSocketImpl.read(NioSocketImpl.java:346) java.base/sun.nio.ch.NioSocketImpl$1.read(NioSocketImpl.java:796) java.base/java.net.Socket$SocketInputStream.read(Socket.java:1099) java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:489) java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:483) java.base/sun.security.ssl.SSLSocketInputRecord.bytesInCompletePacket(SSLSocketInputRecord.java:70) java.base/sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1461) java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1066) org.apache.http.impl.io.SessionInputBufferImpl.streamRead(SessionInputBufferImpl.java:137) org.apache.http.impl.io.SessionInputBufferImpl.fillBuffer(SessionInputBufferImpl.java:153) org.apache.http.impl.BHttpConnectionBase.fillInputBuffer(BHttpConnectionBase.java:330) org.apache.http.impl.BHttpConnectionBase.isStale(BHttpConnectionBase.java:350) org.apache.http.impl.conn.CPool.validate(CPool.java:71) org.apache.http.impl.conn.CPool.validate(CPool.java:45) org.apache.http.pool.AbstractConnPool$2.get(AbstractConnPool.java:256) <== monitors:1 org.apache.http.pool.AbstractConnPool$2.get(AbstractConnPool.java:198) org.apache.http.impl.conn.PoolingHttpClientConnectionManager.leaseConnection(PoolingHttpClientConnectionManager.java:306) org.apache.http.impl.conn.PoolingHttpClientConnectionManager$1.get(PoolingHttpClientConnectionManager.java:282) org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:190) org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) com.twilio.http.NetworkHttpClient.makeRequest(NetworkHttpClient.java:158) com.twilio.http.HttpClient.reliableRequest(HttpClient.java:68) com.twilio.http.HttpClient.reliableRequest(HttpClient.java:51) com.twilio.http.TwilioRestClient.request(TwilioRestClient.java:74) com.twilio.rest.api.v2010.account.RecordingDeleter.delete(RecordingDeleter.java:63) com.twilio.base.Deleter.delete(Deleter.java:40)

[kwin]

I think it is about time to drop that 3rd party dependency altogether and use Java HTTP Client itself (that requires Java11 or newer though).

[sbansla]

@jerome-cui If someone is overriding NetworkHttpClient if will be a breaking change for those customer.
We can not introduce the breaking change.
But since there is a know issue of virtual thread pinning problem in Java 21 with http client 4.x.x

We will think of some alternative to not introduce breaking change for existing customer and use httpclient5