conjure-java-runtime icon indicating copy to clipboard operation
conjure-java-runtime copied to clipboard

Break: remove retrofit support, remove dependency on okhttp

Open carterkozak opened this issue 5 years ago • 4 comments

Retrofit does not load on jre14+ Retrofit has known security vulnerabilities Retrofit cannot be upgraded without breaking conjure

Before this PR

retrofit and okhttp on the runtime classpath despite not being used in the majority of cases.

After this PR

==COMMIT_MSG== Break: remove retrofit support, remove dependency on okhttp ==COMMIT_MSG==

Possible downsides?

Big break, but we built dialogue to replace okhttp, retrofit, and feign. Consumers may need to add a dependency on the conjure okhttp-clients project and migrate retrofit clients to dialogue.

carterkozak avatar Jan 06 '21 20:01 carterkozak

I'm not sure I like the dependency inversion from jaxrs depends on okhttp to okhttp depends on jaxrs. Might be better to add a new legacy-clients jar with the classes that are migrated out of okhttp-clients.

carterkozak avatar Jan 06 '21 21:01 carterkozak

This PR has been automatically marked as stale because it has not been touched in the last 14 days. If you'd like to keep it open, please leave a comment or add the 'long-lived' label, otherwise it'll be closed in 7 days.

stale[bot] avatar Feb 12 '21 13:02 stale[bot]

I've split out the okhttp decoupling component here: #1955

carterkozak avatar Apr 26 '21 19:04 carterkozak

This PR has been automatically marked as stale because it has not been touched in the last 14 days. If you'd like to keep it open, please leave a comment or add the 'long-lived' label, otherwise it'll be closed in 7 days.

stale[bot] avatar Jun 11 '21 01:06 stale[bot]

👍

carterkozak avatar Dec 01 '23 17:12 carterkozak

Failed to load project - please reach out to #help-devtools or check Aries (stack: 'devtools - prod', service: 'prod - autorelease-bot') to debug

svc-autorelease avatar Dec 01 '23 17:12 svc-autorelease