feat(client/java): upgrade Apache HttpClient to 5

[danielkelemen]

related to #3945

[github-actions]

Java dependency diff

🔄 camunda-root: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
 └─ 🔄 camunda-parent: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
     └─ 🔄 camunda-database-settings: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         ├─ 🔄 camunda-bpm-spring-boot-starter-root: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │   ├─ 🔄 camunda-external-task-client-spring: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │   │   └─ 🔄 camunda-external-task-client: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │   │       └─ ➕ httpclient5:5.3 ✔  
         │   │           ├─ ➕ httpcore5:5.2.4 ✔  
         │   │           ├─ ➕ httpcore5-h2:5.2.4 ✔  
         │   │           │   └─ ➕ httpcore5:5.2.4 ✔  
         │   │           └─ ➕ slf4j-api:1.7.26 ✔  
         │   │       └─ ➖ httpclient:4.5.13 ✔  
         │   │           ├─ ➖ httpcore:4.4.13 ✔  
         │   │           ├─ ➖ commons-logging:1.1.1 ✔  
         │   │           └─ ➖ commons-codec:1.11 ✔  
         │   └─ 🔄 camunda-bpm-spring-boot-starter-external-task-client: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │       └─ 🔄 camunda-external-task-client-spring: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │           └─ (Repeating subtree omitted)  
         ├─ 🔄 camunda-external-task-client-root: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │   └─ 🔄 camunda-external-task-client: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │       └─ (Repeating subtree omitted)  
         ├─ 🔄 camunda-wildfly: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │   ├─ 🔄 camunda-wildfly-modules: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │   │   ├─ 🔄 camunda-connect-http-client: 1.6.0 => 1.6.0  
         │   │   │   └─ 🔄 httpclient: 4.5.13 ✔ => 4.5.13 ✔  
         │   │   │       └─ 🤷 commons-codec: 1.11 ✔ => 1.15 ✔  
         │   │   └─ 🔄 camunda-connect-soap-http-client: 1.6.0 => 1.6.0  
         │   │       └─ 🔄 camunda-connect-http-client: 1.6.0 => 1.6.0  
         │   │           └─ (Repeating subtree omitted)  
         │   └─ 🔄 camunda-wildfly-assembly: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │       └─ 🔄 camunda-wildfly-modules: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
         │           └─ (Repeating subtree omitted)  
         └─ 🔄 camunda-wildfly26: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
             └─ 🔄 camunda-wildfly26-modules: 7.21.0-SNAPSHOT => 7.21.0-SNAPSHOT  
                 ├─ 🔄 camunda-connect-http-client: 1.6.0 => 1.6.0  
                 │   └─ (Repeating subtree omitted)  
                 └─ 🔄 camunda-connect-soap-http-client: 1.6.0 => 1.6.0  
                     └─ (Repeating subtree omitted)  

Module details

httpclient:4.5.13

Declared licenses:

• Apache-2.0 ✔

Links:

• website
• distribution
• issue-tracker
• mailing-list
• vcs

httpclient5:5.3

Declared licenses:

• Apache-2.0 ✔

Links:

• website
• distribution
• issue-tracker
• mailing-list
• vcs

slf4j-api:1.7.26

Declared licenses:

• MIT ✔

Links:

• website
• distribution
• vcs

httpcore5:5.2.4

Declared licenses:

• Apache-2.0 ✔

Links:

• website
• distribution
• issue-tracker
• mailing-list
• vcs

httpcore5-h2:5.2.4

Declared licenses:

• Apache-2.0 ✔

Links:

• website
• distribution
• issue-tracker
• mailing-list
• vcs

commons-codec:1.11

Declared licenses:

• Apache-2.0 ✔

Links:

• website
• build-system
• distribution
• issue-tracker
• mailing-list
• vcs

commons-codec:1.15

Declared licenses:

• Apache-2.0 ✔

Links:

• website
• build-system
• distribution
• issue-tracker
• mailing-list
• vcs

Checklist

Unique changes

• commons-codec: 1.11 ✔ => 1.15 ✔
• httpclient: 4.5.13 ✔ => 4.5.13 ✔

Unique additions

• httpclient5: 5.3 ✔
• slf4j-api: 1.7.26 ✔
• httpcore5: 5.2.4 ✔
• httpcore5-h2: 5.2.4 ✔

Developer comments

Glossary

Limitations

• The reported transitive dependencies may not always be accurate in a multi-module project.
  The SBOM file format represents a unique dependency (coordinates + type) only once. In a multi-module
  project a dependency can be declared in multiple locations with different exclusions of transitive dependencies
  or different version overrides for transitive dependencies.

Emojies

• ✔: All licenses are on the Go list
• ⚠: (At least one) license is on the Caution list
• ❌: (At least one) license is on the Stop list
• ❓: (At least one) license cannot be determined or is unknown
• ‼: Dependency has multiple licenses declared
• ⬆: New dependency version is higher than previous
• ⬇: New dependency version is lower than previous
• 🔄: Dependency version is equal and the dependencies of this component changed (e.g. when comparing snapshots)
• 🤷: The change of the dependency version can not be determined further (e.g. because the version does not follow semantic versioning)

[yanavasileva]

👍 Looks good. I have one question and one remark.
❌ We need to run the CI for spring-boot as well (one IT but still), as the java client is a dependency of the spring boot client.
🙃 Also I will be curios to see just in case CI results for jdk 17 (default-build or jdk).

[github-actions]

Dependency Tree Diff

diff -r /base/clients/java/client/dependencies.txt /pr/clients/java/client/dependencies.txt
13,14d12
<    commons-codec:commons-codec:jar:1.11:compile:/root/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar
<    commons-logging:commons-logging:jar:1.1.1:compile:/root/.m2/repository/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.jar
18,20c16,18
<    org.apache.httpcomponents:httpclient:jar:4.5.13:compile:/root/.m2/repository/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar
<    org.apache.httpcomponents:httpcore:jar:4.4.13:compile:/root/.m2/repository/org/apache/httpcomponents/httpcore/4.4.13/httpcore-4.4.13.jar
<    org.apache.httpcomponents:httpmime:jar:4.5.13:test:/root/.m2/repository/org/apache/httpcomponents/httpmime/4.5.13/httpmime-4.5.13.jar
---
>    org.apache.httpcomponents.client5:httpclient5:jar:5.3:compile:/root/.m2/repository/org/apache/httpcomponents/client5/httpclient5/5.3/httpclient5-5.3.jar
>    org.apache.httpcomponents.core5:httpcore5-h2:jar:5.2.4:compile:/root/.m2/repository/org/apache/httpcomponents/core5/httpcore5-h2/5.2.4/httpcore5-h2-5.2.4.jar
>    org.apache.httpcomponents.core5:httpcore5:jar:5.2.4:compile:/root/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.2.4/httpcore5-5.2.4.jar
diff -r /base/spring-boot-starter/starter-client/spring/dependencies.txt /pr/spring-boot-starter/starter-client/spring/dependencies.txt
9,10d8
<    commons-codec:commons-codec:jar:1.15:compile:/root/.m2/repository/commons-codec/commons-codec/1.15/commons-codec-1.15.jar
<    commons-logging:commons-logging:jar:1.2:compile:/root/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
14,15c12,14
<    org.apache.httpcomponents:httpclient:jar:4.5.13:compile:/root/.m2/repository/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar
<    org.apache.httpcomponents:httpcore:jar:4.4.16:compile:/root/.m2/repository/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar
---
>    org.apache.httpcomponents.client5:httpclient5:jar:5.2.1:compile:/root/.m2/repository/org/apache/httpcomponents/client5/httpclient5/5.2.1/httpclient5-5.2.1.jar
>    org.apache.httpcomponents.core5:httpcore5-h2:jar:5.2.3:compile:/root/.m2/repository/org/apache/httpcomponents/core5/httpcore5-h2/5.2.3/httpcore5-h2-5.2.3.jar
>    org.apache.httpcomponents.core5:httpcore5:jar:5.2.3:compile:/root/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.2.3/httpcore5-5.2.3.jar
diff -r /base/spring-boot-starter/starter-client/spring-boot/dependencies.txt /pr/spring-boot-starter/starter-client/spring-boot/dependencies.txt
11,12d10
<    commons-codec:commons-codec:jar:1.15:compile:/root/.m2/repository/commons-codec/commons-codec/1.15/commons-codec-1.15.jar
<    commons-logging:commons-logging:jar:1.2:compile:/root/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
21,22c19,21
<    org.apache.httpcomponents:httpclient:jar:4.5.13:compile:/root/.m2/repository/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar
<    org.apache.httpcomponents:httpcore:jar:4.4.16:compile:/root/.m2/repository/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar
---
>    org.apache.httpcomponents.client5:httpclient5:jar:5.2.1:compile:/root/.m2/repository/org/apache/httpcomponents/client5/httpclient5/5.2.1/httpclient5-5.2.1.jar
>    org.apache.httpcomponents.core5:httpcore5-h2:jar:5.2.3:compile:/root/.m2/repository/org/apache/httpcomponents/core5/httpcore5-h2/5.2.3/httpcore5-h2-5.2.3.jar
>    org.apache.httpcomponents.core5:httpcore5:jar:5.2.3:compile:/root/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.2.3/httpcore5-5.2.3.jar

[yanavasileva]

👍 Good to go when the CI runs.