From 9a0c25e76bdce9ccd44e354faf8d3417f98eb7aa Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Mon, 19 Oct 2026 13:50:24 +0000
Subject: [PATCH 1/2] fix(deps): build and release with dependencies from
 Airlock only

---
 .kokoro/build.sh |  2 +-
 pom.xml          | 55 ++++++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 52 insertions(+), 5 deletions(-)

diff --git a/.kokoro/build.sh b/.kokoro/build.sh
index 8fc8df860..379bc81fc 100755
--- a/.kokoro/build.sh
+++ b/.kokoro/build.sh
@@ -104,7 +104,7 @@ samples)
     fi
     ;;
 clirr)
-    mvn -B -ntp -Denforcer.skip=true clirr:check
+    mvn -B -ntp -Denforcer.skip=true -P=clirr-compatibility-check clirr:check
     RETURN_CODE=$?
     ;;
 *)
diff --git a/pom.xml b/pom.xml
index b67f08e88..78c6f0f35 100644
--- a/pom.xml
+++ b/pom.xml
@@ -369,6 +369,53 @@
           <groupId>org.codehaus.mojo</groupId>
           <artifactId>findbugs-maven-plugin</artifactId>
           <version>3.0.5</version>
+          <dependencies>
+            <!--
+              Airlock (maven-3p-trusted) has no approved license for antlr 2.7.2
+              and plexus-i18n 1.0-beta-7, which this plugin pulls in through
+              doxia-site-renderer 1.7.
+            -->
+            <dependency>
+              <groupId>antlr</groupId>
+              <artifactId>antlr</artifactId>
+              <version>2.7.7</version>
+            </dependency>
+            <dependency>
+              <groupId>org.codehaus.plexus</groupId>
+              <artifactId>plexus-i18n</artifactId>
+              <version>1.0-beta-10</version>
+              <exclusions>
+                <!-- Its parent adds old Plexus container JARs that Airlock does not have. Maven core provides them. -->
+                <exclusion>
+                  <groupId>*</groupId>
+                  <artifactId>*</artifactId>
+                </exclusion>
+              </exclusions>
+            </dependency>
+          </dependencies>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.felix</groupId>
+          <artifactId>maven-bundle-plugin</artifactId>
+          <version>5.1.9</version>
+          <dependencies>
+            <!--
+              Airlock (maven-3p-trusted) has no approved license for plexus-i18n 1.0-beta-7,
+              which this plugin pulls in through doxia-site-renderer 1.0.
+            -->
+            <dependency>
+              <groupId>org.codehaus.plexus</groupId>
+              <artifactId>plexus-i18n</artifactId>
+              <version>1.0-beta-10</version>
+              <exclusions>
+                <!-- Its parent adds old Plexus container JARs that Airlock does not have. Maven core provides them. -->
+                <exclusion>
+                  <groupId>*</groupId>
+                  <artifactId>*</artifactId>
+                </exclusion>
+              </exclusions>
+            </dependency>
+          </dependencies>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
@@ -575,11 +622,11 @@
           https://github.com/googleapis/java-shared-config/issues/956
           Extracting this plugin declaration as a profile enables us to disable
           the CLIRR dependency resolution by `mvn -P=-clirr-compatibility-check ...`
+          The profile is opt-in: the CLIRR CI job enables it with
+          `-P=clirr-compatibility-check`. Builds that use only Airlock do not
+          resolve the CLIRR dependencies, such as plexus-components 1.1.4 and
+          classworlds 1.1-alpha-2, which have no approved license in Airlock.
       -->
-      <activation>
-        <!-- The compatibility check runs by default in CIs -->
-        <jdk>[1.8,)</jdk>
-      </activation>
       <build>
         <plugins>
           <plugin>

From a9559fa4ad55406a638f5aadb132fd26771d86eb Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Tue, 20 Oct 2026 00:40:46 +0000
Subject: [PATCH 2/2] build: remove duplicate maven-bundle-plugin version from
 submodules

---
 google-http-client-apache-v2/pom.xml | 1 -
 google-http-client-apache-v5/pom.xml | 1 -
 google-http-client/pom.xml           | 1 -
 3 files changed, 3 deletions(-)

diff --git a/google-http-client-apache-v2/pom.xml b/google-http-client-apache-v2/pom.xml
index 219efdf22..0fd9da171 100644
--- a/google-http-client-apache-v2/pom.xml
+++ b/google-http-client-apache-v2/pom.xml
@@ -59,7 +59,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-http-client-apache-v5/pom.xml b/google-http-client-apache-v5/pom.xml
index 05e6aac0b..9699a83b2 100644
--- a/google-http-client-apache-v5/pom.xml
+++ b/google-http-client-apache-v5/pom.xml
@@ -59,7 +59,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-http-client/pom.xml b/google-http-client/pom.xml
index 5252342a4..50e131d9a 100644
--- a/google-http-client/pom.xml
+++ b/google-http-client/pom.xml
@@ -90,7 +90,6 @@
       <plugin>   
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>