deps: EOL replace commons-httpclient 3.1 with org.apache.httpcomponents.client5:httpclient5 (closes 1 CVE)

[natechadwick-intsof]

Summary

Replace commons-httpclient:commons-httpclient:3.1 (EOL since 2007) with org.apache.httpcomponents.client5:httpclient5:5.6.3 project-wide. httpclient5:5.6.3 is already in the root pom's dependencyManagement (added by #79), so no new dep is needed.

The 3.x line has been EOL for ~18 years. The 5.x line is the maintained successor with a very different API surface (3.x was procedural / per-method; 5.x is fluent builders + response handlers). This is a real API migration, not a package rename — every call site needs to be rewritten against the new client API.

What changes (in 3 layers)

1. Pom cleanup (12 files + root pom)

Remove the 12 direct <dependency>commons-httpclient:commons-httpclient</dependency> blocks (and 5 transitive-dep exclusion blocks) from the module poms listed below. The root pom has no commons-httpclient direct dep — it only manages the version for module-level declarations. The 3.x line's version property (<commons.httpclient.version>3.1</commons.httpclient.version>) will also be deleted.

2. Migration of 29 .java files (full API rewrite)

This is the bulk of the work. 29 files use 39 distinct org.apache.commons.httpclient.* classes. The migration mapping:

3.x	5.x
HttpClient (top-level client)	org.apache.hc.client5.http.classic.HttpClient
HttpClient.executeMethod(HttpMethod)	httpClient.execute(request, responseHandler) or httpClient.execute(request) returning a ClassicHttpResponse
new GetMethod(url) / new PostMethod(url) / new PutMethod(url) / new HeadMethod(url) / new DeleteMethod(url)	HttpGet(uri) / HttpPost(uri) / HttpPut(uri) / HttpHead(uri) / HttpDelete(uri) (from org.apache.hc.core5.http.io.entity helpers + org.apache.hc.core5.net.URIBuilder)
HttpMethod.getResponseBodyAsString()	ClassicHttpResponse.getEntity() + EntityUtils.toString(entity, charset) (with try-with-resources)
HttpMethod.setRequestHeader(name, value)	request.setHeader(name, value)
HttpMethod.getRequestHeader(name)	request.getHeader(name) (returns Header, same API)
HttpMethod.getParams().setParameter(...)	RequestConfig.custom().setXxx(...).build() + request.setConfig(config)
HttpState / HttpClient.getState()	HttpClientContext + httpClient.execute(request, context) (per-request)
HostConfiguration	HttpHost (passed to httpClient.execute(request, host, context) or RequestConfig setProxy)
MultiThreadedHttpConnectionManager	PoolingHttpClientConnectionManager
DefaultHttpMethodRetryHandler	DefaultHttpRequestRetryHandler (or HttpRequestRetryStrategy in 5.x)
ConnectTimeoutException	org.apache.hc.core5.http.ConnectionClosedException / ConnectTimeoutException (in 5.x)
AuthPolicy.getDefault() / AuthScope.ANY	org.apache.hc.client5.http.auth.AuthScope.ANY (5.x consolidated)
BasicScheme	org.apache.hc.client5.http.auth.BasicScheme
Credentials / UsernamePasswordCredentials	org.apache.hc.client5.http.auth.Credentials / UsernamePasswordCredentials (5.x)
MultipartRequestEntity + Part	org.apache.hc.client5.http.entity.mime.MultipartEntityBuilder (5.x has a builder API)
StringRequestEntity	org.apache.hc.core5.http.io.entity.StringEntity
InputStreamRequestEntity	org.apache.hc.core5.http.io.entity.InputStreamEntity
EntityEnclosingMethod	HttpEntityEnclosingRequestBase (5.x)
DefaultHttpMethodRetryHandler	DefaultHttpRequestRetryHandler
HttpStatus.SC_OK etc.	org.apache.hc.core5.http.HttpStatus.SC_OK (mostly unchanged, package moved)
HttpClientError	org.apache.hc.core5.http.HttpException / explicit status check
HttpException	org.apache.hc.core5.http.HttpException (unchanged)
org.apache.commons.httpclient.Cookie	org.apache.hc.client5.http.cookie.Cookie
org.apache.commons.httpclient.cookie.CookiePolicy	org.apache.hc.client5.http.cookie.CookiePolicy (5.x)
org.apache.commons.httpclient.URI	java.net.URI (5.x uses standard URI, or org.apache.hc.core5.net.URIBuilder for construction)
org.apache.commons.httpclient.URIException	java.net.URISyntaxException
org.apache.commons.httpclient.Header	org.apache.hc.core5.http.Header
org.apache.commons.httpclient.NameValuePair	org.apache.hc.core5.http.NameValuePair
org.apache.commons.httpclient.params.HttpMethodParams	org.apache.hc.client5.http.config.RequestConfig
org.apache.commons.httpclient.params.HttpConnectionParams	org.apache.hc.client5.http.config.ConnectionConfig
org.apache.commons.httpclient.protocol.Protocol	org.apache.hc.core5.http.ssl.SSLContexts (different API — use a ConnectionSocketFactory)
org.apache.commons.httpclient.protocol.SecureProtocolSocketFactory	org.apache.hc.client5.http.socket.SSLConnectionSocketFactory (or PlainConnectionSocketFactory for non-SSL)
org.apache.commons.httpclient.protocol.SSLProtocolSocketFactory	org.apache.hc.client5.http.socket.SSLConnectionSocketFactory (5.x)
org.apache.commons.httpclient.protocol.ProtocolSocketFactory	org.apache.hc.client5.http.socket.ConnectionSocketFactory
org.apache.commons.httpclient.auth.AuthPolicy	org.apache.hc.client5.http.auth.AuthPolicy (5.x)
org.apache.commons.httpclient.auth.AuthScope	org.apache.hc.client5.http.auth.AuthScope (5.x)
org.apache.commons.httpclient.auth.BasicScheme	org.apache.hc.client5.http.auth.BasicScheme (5.x)
org.apache.commons.httpclient.MultiThreadedHttpConnectionManager	org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager (5.x)
org.apache.commons.httpclient.SimpleHttpConnectionManager	org.apache.hc.client5.http.impl.io.BasicHttpClientConnectionManager (5.x)
org.apache.commons.httpclient.Credentials	org.apache.hc.client5.http.auth.Credentials (5.x)
org.apache.commons.httpclient.UsernamePasswordCredentials	org.apache.hc.client5.http.auth.UsernamePasswordCredentials (5.x)
org.apache.commons.httpclient.HttpState	org.apache.hc.client5.http.protocol.HttpClientContext (5.x)
org.apache.commons.httpclient.HttpConnectionManager	org.apache.hc.client5.http.io.HttpClientConnectionManager (5.x)
org.apache.commons.httpclient.HttpMethodBase	org.apache.hc.core5.http.io.support.ClassicHttpRequest (or build via HttpGet/HttpPost directly)
org.apache.commons.httpclient.HttpMethod	org.apache.hc.core5.http.HttpRequest (interface) / ClassicHttpRequest (for entities)
org.apache.commons.httpclient.HttpMethodRetryHandler	org.apache.hc.client5.http.HttpRequestRetryStrategy (5.x)
org.apache.commons.httpclient.methods.GetMethod	org.apache.hc.client5.http.classic.methods.HttpGet
org.apache.commons.httpclient.methods.PostMethod	org.apache.hc.client5.http.classic.methods.HttpPost
org.apache.commons.httpclient.methods.PutMethod	org.apache.hc.client5.http.classic.methods.HttpPut
org.apache.commons.httpclient.methods.HeadMethod	org.apache.hc.client5.http.classic.methods.HttpHead
org.apache.commons.httpclient.methods.DeleteMethod	org.apache.hc.client5.http.classic.methods.HttpDelete
org.apache.commons.httpclient.methods.EntityEnclosingMethod	org.apache.hc.client5.http.classic.methods.HttpUriRequestBase (or build via HttpPost)
org.apache.commons.httpclient.methods.InputStreamRequestEntity	org.apache.hc.core5.http.io.entity.InputStreamEntity
org.apache.commons.httpclient.methods.StringRequestEntity	org.apache.hc.core5.http.io.entity.StringEntity
org.apache.commons.httpclient.methods.multipart.MultipartRequestEntity	org.apache.hc.client5.http.entity.mime.MultipartEntityBuilder.build()
org.apache.commons.httpclient.methods.multipart.Part	org.apache.hc.client5.http.entity.mime.MultipartEntityBuilder (addPart / addTextBody)

The 5.x API is well-documented. Each call site requires careful manual translation — there is no mechanical sed that gets the right behavior.

3. Test impacts

Several test files use the 3.x client (PSRestClient, PSPageValidatorTest, etc.). Tests are typically more forgiving (just need to compile) but a smoke test of the affected HTTP integrations is recommended before merge.

Verification (per file)

• ./mvn-env.sh clean install -DskipTests succeeds on Java 1.8
• ./mvn-env.sh spotless:check passes
• ./mvn-env.sh dependency:tree -Dincludes=commons-httpclient:commons-httpclient returns empty (the 3.x dep is gone)
• ./mvn-env.sh dependency:tree -Dincludes=org.apache.httpcomponents.client5:httpclient5 returns the 5.6.3 entry
• No UnsupportedClassVersionError in the build log (the 5.x library is Java 8 compatible)
• A grep for the old coordinate is empty: grep -rln 'org\.apache\.commons\.httpclient' --include='*.java' should return no files in the project source tree
• No reference to <commons.httpclient.version> remains in the root pom

Out of scope (separate issues under #73)

• T2.6 size caps on the other zip sites (follow-up to fix(security): T2.6 Apache Commons hardening (size caps on commons-fileupload + commons-compress) #83; defensive hardening)
• T2.11 SnakeYAML SafeConstructor hardening (16 CVEs)
• commons-beanutils 1.11.0 -> beanutils2 EOL replacement (Jakarta migration)
• commons-configuration 1.10 -> commons-configuration2 EOL replacement (API changes; not just a package rename)
• Moving the project to Java 11+ (parent epic [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73, separate workstream)

References

• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
• HttpClient 5.x migration guide: https://hc.apache.org/httpcomponents-client-5.4.x/current/httpclient5/migration-guide/migration-to-5x.html
• HttpClient 5.x Javadoc: https://javadoc.io/doc/org.apache.httpcomponents.client5/httpclient5/5.6.3/index.html
• commons-httpclient 3.x EOL: https://commons.apache.org/proper/commons-httpclient/
• Tier 2 EOL plan: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md#t26--apache-commons-hardening

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.

[natechadwick-intsof]

Deferring this to a follow-up session. The 3.1 → 5.x migration is a real API rewrite across 29 files (39 distinct classes: HttpClient, HttpMethod, Get/Post/Put/Head/DeleteMethod, MultiThreadedHttpConnectionManager, SSLProtocolSocketFactory, etc.) and would take multiple sessions to migrate + test properly. The 5.x library is in the root pom from #79 so the dependency is ready when work begins. Tracking here for visibility.