From 45ce93c2c213e292e14dc854fcc9e864f72d46ea Mon Sep 17 00:00:00 2001
From: Lawrence Qiu <lawrenceqiu@google.com>
Date: Mon, 22 Jun 2026 21:42:22 +0000
Subject: [PATCH] fix: upgrade commons-codec to 1.14 to resolve security
 vulnerability

Upgrades the transitive dependency `commons-codec:commons-codec` (brought in via `httpclient`) to `1.14` to resolve a security vulnerability (SNYK-JAVA-COMMONSCODEC-561518) which affects versions older than 1.14.

We cannot upgrade httpclient further because 4.5.14 is the latest version on the 4.x branch, and upgrading to 5.x would be a breaking change.

BUG=496541059
TAG=agy
CONV=b43d61a6-175a-4130-8ed4-ec217f123c55
---
 pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pom.xml b/pom.xml
index ca68c89db..3ade7f13b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -160,6 +160,17 @@
         <artifactId>xpp3</artifactId>
         <version>${project.xpp3.version}</version>
       </dependency>
+      <!--
+        Force commons-codec to 1.14 to resolve vulnerability (SNYK-JAVA-COMMONSCODEC-561518)
+        introduced transitively by httpclient 4.5.14 (which defaults to 1.11).
+        We cannot upgrade httpclient further because 4.5.14 is the latest version on the 4.x branch,
+        and upgrading to 5.x would be a breaking change.
+      -->
+      <dependency>
+        <groupId>commons-codec</groupId>
+        <artifactId>commons-codec</artifactId>
+        <version>${project.commons-codec.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.apache.httpcomponents</groupId>
         <artifactId>httpclient</artifactId>
@@ -559,6 +570,7 @@
     <project.xpp3.version>1.1.4c</project.xpp3.version>
     <project.apache-httpclient-4.version>4.5.14</project.apache-httpclient-4.version>
     <project.apache-httpcore-4.version>4.4.16</project.apache-httpcore-4.version>
+    <project.commons-codec.version>1.14</project.commons-codec.version>
     <project.apache-httpclient-5.version>5.3.1</project.apache-httpclient-5.version>
     <project.apache-httpcore-5.version>5.2.5</project.apache-httpcore-5.version>
     <project.opencensus.version>0.31.1</project.opencensus.version>