From 25911fd786c3f36607298b0d68769bff1d69270e Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Thu, 22 Oct 2026 17:26:07 +0000
Subject: [PATCH] fix(deps): replace jaxen 1.1.6 and exclude xmlParserAPIs
 2.6.2 for Airlock

---
 google-http-client-android/pom.xml  |  7 +++++++
 google-http-client-findbugs/pom.xml | 10 ++++++++++
 pom.xml                             | 11 ++++++++---
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/google-http-client-android/pom.xml b/google-http-client-android/pom.xml
index 17ee5aff0..8ab4f9b67 100644
--- a/google-http-client-android/pom.xml
+++ b/google-http-client-android/pom.xml
@@ -48,6 +48,13 @@
       <artifactId>android</artifactId>
       <version>4.1.1.4</version>
       <scope>provided</scope>
+      <exclusions>
+        <!-- Airlock has no approved license for xmlParserAPIs 2.6.2. The JDK has these APIs. -->
+        <exclusion>
+          <groupId>xerces</groupId>
+          <artifactId>xmlParserAPIs</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
   </dependencies>
 </project>
diff --git a/google-http-client-findbugs/pom.xml b/google-http-client-findbugs/pom.xml
index 456855a85..fbdb68897 100644
--- a/google-http-client-findbugs/pom.xml
+++ b/google-http-client-findbugs/pom.xml
@@ -48,6 +48,16 @@
       </plugin> 
     </plugins>
   </build>
+  <dependencyManagement>
+    <dependencies>
+      <!-- findbugs 3.0.1 uses jaxen 1.1.6, which has no approved license in Airlock. -->
+      <dependency>
+        <groupId>jaxen</groupId>
+        <artifactId>jaxen</artifactId>
+        <version>1.2.0</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
   <dependencies>
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
diff --git a/pom.xml b/pom.xml
index 78c6f0f35..36bf160f3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -371,15 +371,20 @@
           <version>3.0.5</version>
           <dependencies>
             <!--
-              Airlock (maven-3p-trusted) has no approved license for antlr 2.7.2
-              and plexus-i18n 1.0-beta-7, which this plugin pulls in through
-              doxia-site-renderer 1.7.
+              Airlock (maven-3p-trusted) has no approved license for antlr 2.7.2, jaxen 1.1.6,
+              and plexus-i18n 1.0-beta-7, which this plugin pulls in through findbugs 3.0.1
+              and doxia-site-renderer 1.7.
             -->
             <dependency>
               <groupId>antlr</groupId>
               <artifactId>antlr</artifactId>
               <version>2.7.7</version>
             </dependency>
+            <dependency>
+              <groupId>jaxen</groupId>
+              <artifactId>jaxen</artifactId>
+              <version>1.2.0</version>
+            </dependency>
             <dependency>
               <groupId>org.codehaus.plexus</groupId>
               <artifactId>plexus-i18n</artifactId>