async-http-client version 2.10.4 security issues

[pmologni]

Describe the bug
current async-http-client version 2.10.4 have 2 High Severity security issues

Can you please bump it the the latest version?

https://snyk.io/test/github/AsyncHttpClient/async-http-client

Cheers,
Paolo

[aheritier]

Hi @pmologni

AFAICS 2.10.4 is the latest release available and deployed on Maven central cc @slandelle

My understanding of https://snyk.io/test/github/cloudbees/zendesk-java-client is that the issue is in netty and not async-http-client

• https://snyk.io/vuln/SNYK-JAVA-IONETTY-543669

• https://snyk.io/vuln/SNYK-JAVA-IONETTY-543490

  I proposed an update of the dependency in async-http-client : Upgrade Netty 4.1.42 -> 4.1.44 AsyncHttpClient/async-http-client#1694

[pmologni]

Thanks @aheritier!

[aheritier]

@slandelle merged the PR but it is useless in our context. These security issues are on the server side of Netty. async-http-client is using the client side.