fix: Ensure async clients use a thread factory that SLF4J-logs on uncaught Errors by chadlwilson · Pull Request #82 · jeremylong/open-vulnerability-clients

chadlwilson · 2026-01-02T17:27:29Z

Per dependency-check/DependencyCheck#8178 currently if the async http client threads die due to a JVM Error[1], the errors can be swallowed, depending on what your application does with System.err.

That can make the root cause of the later failures difficult to determine without enabling debug logging (or impossible if an application complete swallows System.err rather than redirecting it somewhere you can see).

This change alters the default Apache HTTPClient thread factory to define an uncaught exception handler which uses SLF4J like the rest of the library.

I've left the logs at ERROR level, but arguably they are fatal, as they potentially leave the cached http clients in a broken state.

[1] The HTTP Client Async IO workers catch and report Exceptions, but not Errors:

    public void execute() {
        if (this.status.compareAndSet(IOReactorStatus.INACTIVE, IOReactorStatus.ACTIVE)) {
            try {
                doExecute();
            } catch (final ClosedSelectorException ignore) {
                // ignore
            } catch (final Exception ex) {
                logException(ex);
            } finally {
                try {
                    doTerminate();
                } catch (final Exception ex) {
                    logException(ex);
                } finally {
                    close(CloseMode.IMMEDIATE);
                }
            }
        }
    }

Copilot

Pull request overview

This PR addresses issue #8178 by ensuring that uncaught exceptions in Apache HTTP async client threads are logged via SLF4J instead of being potentially swallowed when written to System.err. This improves debuggability when HTTP client threads fail due to JVM errors.

Key Changes:

Introduced a new LoggingThreadFactory that wraps Apache's DefaultThreadFactory and sets an uncaught exception handler on all created threads
Updated both cached and non-cached HTTP client configurations in RateLimitedClient to use the new thread factory
Added a public getDefaultThreadFactory() method to HttpAsyncClientSupplier for reusability

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
src/main/java/io/github/jeremylong/openvulnerability/client/HttpAsyncClientSupplier.java	Adds LoggingThreadFactory class with SLF4J-based uncaught exception handler and exposes it via getDefaultThreadFactory() method
src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedClient.java	Integrates the new thread factory into HTTP client builders for both cached and non-cached configurations

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…aught exceptions

jeremylong

LGTM

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <[email protected]>

chadlwilson · 2026-01-12T12:23:03Z

I ran CoPilot several times already (as you can see above) and it keeps on generating new low value suggestions on every iteration that it didn't mention earlier.

IMHO a bit of a waste of time after a while.

chadlwilson · 2026-01-26T09:24:02Z

Any chance of cutting a patch release with this in it, so can update within ODC?

jeremylong · 2026-01-26T12:36:30Z

absolutely.

Copilot AI review requested due to automatic review settings January 2, 2026 17:27

Copilot started reviewing on behalf of chadlwilson January 2, 2026 17:27 View session

Copilot AI reviewed Jan 2, 2026

View reviewed changes

chadlwilson changed the title ~~fix: Ensure async clients use a thread factory/threadgroup that SLF4J-logs on uncaught exceptions~~ fix: Ensure async clients use a thread factory that SLF4J-logs on uncaught Errors Jan 2, 2026

fix: Ensure async clients use a thread factory that SLF4J-logs on unc…

41c6119

…aught exceptions

chadlwilson force-pushed the fix-io-thread-death-logging branch from 95556a5 to 41c6119 Compare January 2, 2026 17:37

jeremylong requested a review from Copilot January 12, 2026 11:47

Copilot started reviewing on behalf of jeremylong January 12, 2026 11:48 View session

jeremylong previously approved these changes Jan 12, 2026

View reviewed changes

Copilot AI reviewed Jan 12, 2026

View reviewed changes

jeremylong reviewed Jan 12, 2026

View reviewed changes

Comment thread src/main/java/io/github/jeremylong/openvulnerability/client/HttpAsyncClientSupplier.java Outdated

jeremylong reviewed Jan 12, 2026

View reviewed changes

Comment thread src/main/java/io/github/jeremylong/openvulnerability/client/HttpAsyncClientSupplier.java

fix: apply suggestions from copilot

fc24c9e

jeremylong dismissed their stale review via fc24c9e January 12, 2026 12:03

docs: apply suggestion from copilot

14c1523

Co-authored-by: Copilot <[email protected]>

jeremylong requested a review from Copilot January 12, 2026 12:05

Copilot started reviewing on behalf of jeremylong January 12, 2026 12:05 View session

Copilot AI reviewed Jan 12, 2026

View reviewed changes

jeremylong reviewed Jan 12, 2026

View reviewed changes

Comment thread src/main/java/io/github/jeremylong/openvulnerability/client/HttpAsyncClientSupplier.java Outdated

fix: apply suggestions from code review

b611536

Co-authored-by: Copilot <[email protected]>

jeremylong reviewed Jan 12, 2026

View reviewed changes

Comment thread src/main/java/io/github/jeremylong/openvulnerability/client/HttpAsyncClientSupplier.java

docs: apply suggestion from @jeremylong

8289295

jeremylong approved these changes Jan 12, 2026

View reviewed changes

jeremylong merged commit 65e1aa2 into jeremylong:main Jan 12, 2026
1 check passed

chadlwilson deleted the fix-io-thread-death-logging branch January 12, 2026 12:23

chadlwilson mentioned this pull request Jan 26, 2026

fix: improve logging of unexpected Java Errors during processing of NVD dependency-check/DependencyCheck#8250

Merged

Uh oh!

Conversation

chadlwilson commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jeremylong left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chadlwilson commented Jan 12, 2026

Uh oh!

chadlwilson commented Jan 26, 2026

Uh oh!

jeremylong commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chadlwilson commented Jan 2, 2026 •

edited

Loading