From 1d4a47727843bc28e1b0060679618218986a04ba Mon Sep 17 00:00:00 2001
From: Lawrence Qiu <lawrenceqiu@google.com>
Date: Tue, 30 Jun 2026 15:22:20 +0000
Subject: [PATCH] fix: declare commons-codec as direct dependency in
 google-http-client

This ensures that consumers of google-http-client (like google-auth-library)
resolve commons-codec to the intended version (1.14) instead of falling
back to the transitive default from httpclient (1.11).

TAG=agy
CONV=434bf939-537d-4929-a784-244f71a2b946
---
 google-http-client/pom.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/google-http-client/pom.xml b/google-http-client/pom.xml
index 16a8dd127..dee07fe64 100644
--- a/google-http-client/pom.xml
+++ b/google-http-client/pom.xml
@@ -25,6 +25,7 @@
             <ignoredUnusedDeclaredDependencies>
               <ignoredUnusedDeclaredDependency>io.opencensus:opencensus-impl</ignoredUnusedDeclaredDependency>
               <ignoredUnusedDeclaredDependency>io.grpc:grpc-context</ignoredUnusedDeclaredDependency>
+              <ignoredUnusedDeclaredDependency>commons-codec:commons-codec</ignoredUnusedDeclaredDependency>
             </ignoredUnusedDeclaredDependencies>
           </configuration>
         </plugin>
@@ -126,6 +127,10 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>commons-codec</groupId>
+      <artifactId>commons-codec</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.apache.httpcomponents</groupId>
       <artifactId>httpcore</artifactId>