Bump httpclient5 5.3.1 -> 5.6.4, httpcore5/httpcore5-h2 -> 5.4.3

[adimiz1]

Summary

• Bump httpclient5 5.3.1 -> 5.6.4 and httpcore5 5.3.5 -> 5.4.3.
• Pin httpcore5-h2 5.4.3 explicitly. It was still resolving transitively to 5.2.4 through httpclient5 5.3.1, so the earlier httpcore5 bump did not fix the h2 CVE.
• Update the ApacheHttpClient/<version> user-agent default in ApiStrategy and UploaderStrategy to 5.6.4.

httpclient5 5.6.4 is built against httpcore 5.4.3 and still targets Java 1.8.

Tickets

• VIDEO-20814: DoS in httpcore5-h2 (needs >= 5.3.5)
• VIDEO-20995: HPACK unbounded allocation in httpcore5-h2 (needs >= 5.4.2)
• VIDEO-20996: HTTP/1.1 header parsing unbounded allocation in httpcore5-h2 (needs >= 5.4.2)
• VIDEO-21159: classic ContentCompressionExec leaks pooled connections (needs >= 5.6.3)
• VIDEO-21177: CVE-2026-71290, async hostname verification in 5.4-alpha to 5.6.3 (floor 5.6.4)

Test plan

• dependencies --configuration runtimeClasspath: httpcore5 and httpcore5-h2 resolve only to 5.4.3
• Compiles on JDK 8 (only the existing setConnectTimeout deprecation notes)
• core: 275 tests, 0 failures
• http5: 206 tests, 0 failures, 39 skipped (same skips as before)
• CI matrix green

CHANGELOG will be updated at release time.

🤖 Generated with Claude Code