Upgrade httpclient5 5.2.1 -> 5.6.1 (pin httpcore5 5.4)

[devin-ai-integration]

Summary

Bumps the test-scoped Apache HttpClient 5 to the latest stable 5.x (5.6.1, published 2026-04-14) and pins the companion httpcore5 line so the Spring Boot 2.6.3 BOM stops downgrading it. Build-file change only — no source changes.

-testImplementation 'org.apache.httpcomponents.client5:httpclient5:5.2.1'
+testImplementation 'org.apache.httpcomponents.client5:httpclient5:5.6.1'
+
+ext['httpclient5.version'] = '5.6.1'
+ext['httpcore5.version']   = '5.4'

Why the ext overrides

The Boot 2.6.3 BOM pins httpclient5.version=5.1.2 / httpcore5.version=5.1.3, and the io.spring.dependency-management plugin applies those to transitive resolution. On main this already produced a split classpath: httpclient5:5.2.1 requested httpcore5:5.2, but the BOM rule dragged it back to 5.1.3 (org.apache.httpcomponents.core5:httpcore5:5.2 -> 5.1.3). 5.6.1 requires httpcore5 5.4, so the managed properties are overridden rather than adding new dependency lines; httpclient5.version is overridden too so transitive requests (Selenium's webdrivermanager at 5.2.1, docker-java-transport-httpclient5 at 5.0.3) cannot be managed back down.

dependencyInsight evidence (target version actually resolved)

./gradlew dependencyInsight --configuration testRuntimeClasspath --dependency org.apache.httpcomponents.client5:httpclient5

org.apache.httpcomponents.client5:httpclient5:5.6.1 (selected by rule)
org.apache.httpcomponents.client5:httpclient5:5.6.1
\--- testRuntimeClasspath
org.apache.httpcomponents.client5:httpclient5:5.0.3 -> 5.6.1
\--- com.github.docker-java:docker-java-transport-httpclient5:3.3.4 -> io.github.bonigarcia:webdrivermanager:5.6.2
org.apache.httpcomponents.client5:httpclient5:5.2.1 -> 5.6.1
\--- io.github.bonigarcia:webdrivermanager:5.6.2

... --dependency org.apache.httpcomponents.core5

org.apache.httpcomponents.core5:httpcore5:5.4     (selected by rule)
org.apache.httpcomponents.core5:httpcore5-h2:5.4  (selected by rule)

All upgrades resolve upward; no conflict-resolution downgrade and no two versions of the family on the classpath. httpclient5 5.6.1 targets Java 8 bytecode, so it is fine on the Java 11 / Boot 2.6.3 ceiling — no Boot 3 / Java 17 requirement was hit.

API migration

No source changes needed. grep -rn "org.apache.hc" src/ returns zero matches — httpclient5 is present only as a transitive runtime need of the Selenium/webdrivermanager stack, never imported by repo code. compileTestJava is clean.

Gate

JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64 ./gradlew clean test spotlessCheck -x jacocoTestCoverageVerification

	baseline (main @ 3037fa5)	this branch
result	BUILD SUCCESSFUL	BUILD SUCCESSFUL
tests	68	68
failures / errors / skipped	0 / 0 / 0	0 / 0 / 0
spotlessCheck	green	green

Baseline was re-run first-hand on untouched main before editing.

Pre-existing on base, not addressed here

• jacocoTestCoverageVerification fails on main at ~0.33 instruction coverage against the 0.80 rule in build.gradle. CI excludes it (./gradlew clean test -x jacocoTestCoverageVerification), and this PR excludes it identically. The threshold was not lowered and no tests were added.
• Gradle 7.4 emits spotlessJava implicit-dependency and deprecation warnings on both base and this branch; unrelated to this change.

Out of scope by assignment: selenium-java, webdrivermanager, testng, and every other dependency in build.gradle are untouched.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/31a2a780b4ab41a4bf4dc5a32b842b7e
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring