This is a heads up regarding usage of Apache httpcomponents.
We are considering to update httpcomponents (httpcore and httpclient) to 5.0.2 for JGit/EGit.
See [1] and the changes adding these new versions to Orbit [2].
I still need to add conscrypt to Orbit which is an optional dependency for the
http 2.0 implementation in httpcore5-h2.
Let us know if there are any concerns regarding this plan.
Have you considered (or even evaluated) usage of Java 11 HttpClient instead?
JGit today's default uses HttpURLConnection in the core org.eclipse.jgit bundle. Optionally
apache httpclient 4.5.10 can be used instead via the org.eclipse.jgit.http.apache bundle.
I am looking at updating the latter to apache httpclient 5.0.2. According to the migration guide API changes
compared to 4.5.10 aren't huge.
We may consider to replace the default implementation using HttpURLConnection in org.eclipse.jgit
with the new Java 11 http client. This would require to update the execution environment for JGit from Java 8 to 11.