From 6948047200fe7d12cadf1badca12646e9370388f Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Thu, 22 Oct 2026 15:55:36 +0000
Subject: [PATCH 1/2] fix(deps): build and release with dependencies from
 Airlock only

---
 .kokoro/build.sh                    |  2 +-
 google-api-client-apache-v5/pom.xml |  1 -
 google-api-client-appengine/pom.xml |  1 -
 google-api-client-gson/pom.xml      |  1 -
 google-api-client-jackson2/pom.xml  |  1 -
 google-api-client-protobuf/pom.xml  |  1 -
 google-api-client-servlet/pom.xml   |  1 -
 google-api-client-xml/pom.xml       |  1 -
 google-api-client/pom.xml           |  1 -
 pom.xml                             | 95 ++++++++++++++++++++++++-----
 10 files changed, 80 insertions(+), 25 deletions(-)

diff --git a/.kokoro/build.sh b/.kokoro/build.sh
index 52c8b5148..dcf17104d 100755
--- a/.kokoro/build.sh
+++ b/.kokoro/build.sh
@@ -110,7 +110,7 @@ samples)
     fi
     ;;
 clirr)
-    mvn -B -ntp -Denforcer.skip=true clirr:check
+    mvn -B -ntp -Denforcer.skip=true -P=clirr-compatibility-check clirr:check
     RETURN_CODE=$?
     ;;
 *)
diff --git a/google-api-client-apache-v5/pom.xml b/google-api-client-apache-v5/pom.xml
index 3a5f5e324..01ddb1422 100644
--- a/google-api-client-apache-v5/pom.xml
+++ b/google-api-client-apache-v5/pom.xml
@@ -54,7 +54,6 @@
             <plugin>
                 <groupId>org.apache.felix</groupId>
                 <artifactId>maven-bundle-plugin</artifactId>
-                <version>5.1.9</version>
                 <executions>
                     <execution>
                         <id>bundle-manifest</id>
diff --git a/google-api-client-appengine/pom.xml b/google-api-client-appengine/pom.xml
index e02d12a8d..218835732 100644
--- a/google-api-client-appengine/pom.xml
+++ b/google-api-client-appengine/pom.xml
@@ -41,7 +41,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-api-client-gson/pom.xml b/google-api-client-gson/pom.xml
index e160a05cb..84e57484b 100644
--- a/google-api-client-gson/pom.xml
+++ b/google-api-client-gson/pom.xml
@@ -39,7 +39,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-api-client-jackson2/pom.xml b/google-api-client-jackson2/pom.xml
index 49fd81310..502092deb 100644
--- a/google-api-client-jackson2/pom.xml
+++ b/google-api-client-jackson2/pom.xml
@@ -39,7 +39,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-api-client-protobuf/pom.xml b/google-api-client-protobuf/pom.xml
index 7cc8a8442..b4ee62b99 100644
--- a/google-api-client-protobuf/pom.xml
+++ b/google-api-client-protobuf/pom.xml
@@ -46,7 +46,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-api-client-servlet/pom.xml b/google-api-client-servlet/pom.xml
index 22ea1b572..d2613778d 100644
--- a/google-api-client-servlet/pom.xml
+++ b/google-api-client-servlet/pom.xml
@@ -40,7 +40,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-api-client-xml/pom.xml b/google-api-client-xml/pom.xml
index 79836c84f..59050436d 100644
--- a/google-api-client-xml/pom.xml
+++ b/google-api-client-xml/pom.xml
@@ -39,7 +39,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/google-api-client/pom.xml b/google-api-client/pom.xml
index 7644bac9a..88b5eba44 100644
--- a/google-api-client/pom.xml
+++ b/google-api-client/pom.xml
@@ -60,7 +60,6 @@
       <plugin>
         <groupId>org.apache.felix</groupId>
         <artifactId>maven-bundle-plugin</artifactId>
-        <version>5.1.9</version>
         <executions>
           <execution>
             <id>bundle-manifest</id>
diff --git a/pom.xml b/pom.xml
index 2184afc60..2915f4377 100644
--- a/pom.xml
+++ b/pom.xml
@@ -343,6 +343,53 @@
           <groupId>org.codehaus.mojo</groupId>
           <artifactId>findbugs-maven-plugin</artifactId>
           <version>3.0.5</version>
+          <dependencies>
+            <!--
+              Airlock (maven-3p-trusted) has no approved license for antlr 2.7.2
+              and plexus-i18n 1.0-beta-7, which this plugin pulls in through
+              doxia-site-renderer 1.7.
+            -->
+            <dependency>
+              <groupId>antlr</groupId>
+              <artifactId>antlr</artifactId>
+              <version>2.7.7</version>
+            </dependency>
+            <dependency>
+              <groupId>org.codehaus.plexus</groupId>
+              <artifactId>plexus-i18n</artifactId>
+              <version>1.0-beta-10</version>
+              <exclusions>
+                <!-- Its parent adds old Plexus container JARs that Airlock does not have. Maven core provides them. -->
+                <exclusion>
+                  <groupId>*</groupId>
+                  <artifactId>*</artifactId>
+                </exclusion>
+              </exclusions>
+            </dependency>
+          </dependencies>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.felix</groupId>
+          <artifactId>maven-bundle-plugin</artifactId>
+          <version>5.1.9</version>
+          <dependencies>
+            <!--
+              Airlock (maven-3p-trusted) has no approved license for plexus-i18n 1.0-beta-7,
+              which this plugin pulls in through doxia-site-renderer 1.0.
+            -->
+            <dependency>
+              <groupId>org.codehaus.plexus</groupId>
+              <artifactId>plexus-i18n</artifactId>
+              <version>1.0-beta-10</version>
+              <exclusions>
+                <!-- Its parent adds old Plexus container JARs that Airlock does not have. Maven core provides them. -->
+                <exclusion>
+                  <groupId>*</groupId>
+                  <artifactId>*</artifactId>
+                </exclusion>
+              </exclusions>
+            </dependency>
+          </dependencies>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
@@ -471,22 +518,6 @@
           </plugins>
         </configuration>
       </plugin>
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>clirr-maven-plugin</artifactId>
-        <configuration>
-          <comparisonVersion>1.27.0</comparisonVersion>
-          <ignoredDifferencesFile>${basedir}/../clirr-ignored-differences.xml</ignoredDifferencesFile>
-          <logResults>true</logResults>
-        </configuration>
-        <executions>
-          <execution>
-            <goals>
-              <goal>check</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>animal-sniffer-maven-plugin</artifactId>
@@ -760,5 +791,37 @@
         </snapshotRepository>
       </distributionManagement>
     </profile>
+    <profile>
+      <id>clirr-compatibility-check</id>
+      <!--
+          https://github.com/googleapis/java-shared-config/issues/956
+          Extracting this plugin declaration as a profile enables us to disable
+          the CLIRR dependency resolution by `mvn -P=-clirr-compatibility-check ...`
+          The profile is opt-in: the CLIRR CI job enables it with
+          `-P=clirr-compatibility-check`. Builds that use only Airlock do not
+          resolve the CLIRR dependencies, such as plexus-components 1.1.4 and
+          classworlds 1.1-alpha-2, which have no approved license in Airlock.
+      -->
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>clirr-maven-plugin</artifactId>
+            <configuration>
+              <comparisonVersion>1.27.0</comparisonVersion>
+              <ignoredDifferencesFile>${basedir}/../clirr-ignored-differences.xml</ignoredDifferencesFile>
+              <logResults>true</logResults>
+            </configuration>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>check</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
   </profiles>
 </project>

From 24c0327dec22160bdf0224ac4357e24691ca79ee Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Thu, 22 Oct 2026 17:42:28 +0000
Subject: [PATCH 2/2] fix(deps): exclude unused xerces:xmlParserAPIs and
 evicted org.osgi.core:4.1.0

---
 google-api-client-android/pom.xml |  7 +++++++
 pom.xml                           | 28 ++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/google-api-client-android/pom.xml b/google-api-client-android/pom.xml
index cfb0a0c7f..cb7703b07 100644
--- a/google-api-client-android/pom.xml
+++ b/google-api-client-android/pom.xml
@@ -42,6 +42,13 @@
       <artifactId>android</artifactId>
       <version>4.1.1.4</version>
       <scope>provided</scope>
+      <exclusions>
+        <!-- Provided by the JDK since Java 1.4; Airlock (maven-3p-trusted) does not have a license for xerces:xmlParserAPIs:2.6.2 -->
+        <exclusion>
+          <groupId>xerces</groupId>
+          <artifactId>xmlParserAPIs</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.http-client</groupId>
diff --git a/pom.xml b/pom.xml
index 2915f4377..063030eff 100644
--- a/pom.xml
+++ b/pom.xml
@@ -389,6 +389,34 @@
                 </exclusion>
               </exclusions>
             </dependency>
+            <!--
+              maven-bundle-plugin 5.1.9 directly depends on org.osgi:org.osgi.core:6.0.0,
+              which evicts the 4.1.0 transitive dependency declared by bundlerepository and utils.
+              Excluding org.osgi.core here stops Maven from probing the evicted 4.1.0 POM,
+              which has no license metadata in Airlock (maven-3p-trusted).
+            -->
+            <dependency>
+              <groupId>org.apache.felix</groupId>
+              <artifactId>org.apache.felix.bundlerepository</artifactId>
+              <version>1.6.6</version>
+              <exclusions>
+                <exclusion>
+                  <groupId>org.osgi</groupId>
+                  <artifactId>org.osgi.core</artifactId>
+                </exclusion>
+              </exclusions>
+            </dependency>
+            <dependency>
+              <groupId>org.apache.felix</groupId>
+              <artifactId>org.apache.felix.utils</artifactId>
+              <version>1.6.0</version>
+              <exclusions>
+                <exclusion>
+                  <groupId>org.osgi</groupId>
+                  <artifactId>org.osgi.core</artifactId>
+                </exclusion>
+              </exclusions>
+            </dependency>
           </dependencies>
         </plugin>
         <plugin>