From 087acc82b0be43d807623e0bb773194fb8294936 Mon Sep 17 00:00:00 2001
From: Alice Li <alicejli@google.com>
Date: Fri, 2 Dec 2022 14:50:07 -0500
Subject: [PATCH 1/4] fix: pinning commons-codec dependency in
 google-api-client

---
 google-api-client/pom.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/google-api-client/pom.xml b/google-api-client/pom.xml
index b1b5d176a..f3dc09686 100644
--- a/google-api-client/pom.xml
+++ b/google-api-client/pom.xml
@@ -117,6 +117,10 @@
     </resources>
   </build>
   <dependencies>
+    <dependency>
+      <groupId>commons-codec</groupId>
+      <artifactId>commons-codec</artifactId>
+    </dependency>
     <dependency>
       <groupId>com.google.oauth-client</groupId>
       <artifactId>google-oauth-client</artifactId>

From 2dd55d9c8770b1d4574c93205bda50b53e9c3854 Mon Sep 17 00:00:00 2001
From: Alice Li <alicejli@google.com>
Date: Fri, 2 Dec 2022 15:10:25 -0500
Subject: [PATCH 2/4] configure maven dependency plugin to ignore commons:codec

---
 pom.xml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pom.xml b/pom.xml
index ce2acd2f0..1201ed4bb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -338,6 +338,22 @@
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-dependency-plugin</artifactId>
           <version>3.3.0</version>
+          <executions>
+            <execution>
+              <id>analyze</id>
+              <goals>
+                <goal>analyze</goal>
+              </goals>
+              <configuration>
+                <failOnWarning>true</failOnWarning>
+
+                <!-- ignore commons:codec for "used but undeclared", "declared but unused", and "non-test scoped" -->
+                <ignoredDependencies>
+                  <ignoredDependency>commons-codec:commons-codec</ignoredDependency>
+                </ignoredDependencies>
+              </configuration>
+            </execution>
+          </executions>
         </plugin>
       </plugins>
     </pluginManagement>

From 95e5eba9df833ee9d2ee8a5c7d022269f73ee2ec Mon Sep 17 00:00:00 2001
From: Tomo Suzuki <suztomo@google.com>
Date: Fri, 2 Dec 2022 15:33:18 -0500
Subject: [PATCH 3/4] dependency plugin configuration without execution
 elements

---
 google-api-client/pom.xml |  7 +++++++
 pom.xml                   | 16 ----------------
 2 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/google-api-client/pom.xml b/google-api-client/pom.xml
index f3dc09686..5275d5014 100644
--- a/google-api-client/pom.xml
+++ b/google-api-client/pom.xml
@@ -104,6 +104,13 @@
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <configuration>
+          <usedDependencies>commons-codec:commons-codec</usedDependencies>
+        </configuration>
+      </plugin>
     </plugins>
 
     <resources>
diff --git a/pom.xml b/pom.xml
index 1201ed4bb..ce2acd2f0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -338,22 +338,6 @@
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-dependency-plugin</artifactId>
           <version>3.3.0</version>
-          <executions>
-            <execution>
-              <id>analyze</id>
-              <goals>
-                <goal>analyze</goal>
-              </goals>
-              <configuration>
-                <failOnWarning>true</failOnWarning>
-
-                <!-- ignore commons:codec for "used but undeclared", "declared but unused", and "non-test scoped" -->
-                <ignoredDependencies>
-                  <ignoredDependency>commons-codec:commons-codec</ignoredDependency>
-                </ignoredDependencies>
-              </configuration>
-            </execution>
-          </executions>
         </plugin>
       </plugins>
     </pluginManagement>

From 93f1259a1f533c02a103633bd606814f39a66b26 Mon Sep 17 00:00:00 2001
From: Tomo Suzuki <suztomo@google.com>
Date: Fri, 2 Dec 2022 15:40:03 -0500
Subject: [PATCH 4/4] docs: adding why commons-codec is here

---
 google-api-client/pom.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/google-api-client/pom.xml b/google-api-client/pom.xml
index 5275d5014..b8401c587 100644
--- a/google-api-client/pom.xml
+++ b/google-api-client/pom.xml
@@ -125,6 +125,9 @@
   </build>
   <dependencies>
     <dependency>
+      <!-- google-api-client itself does not touch commons-codec. Its
+        httpclient's dependency. For security advisories in commons-codec, it
+        declares a newer commons-codec than the one declared by httpclient. -->
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>
     </dependency>