From 7a772b56049c4fd2631237aada7aa677da39f387 Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Fri, 13 Nov 2026 15:16:46 +0000
Subject: [PATCH 1/2] build(deps): bump maven-project-info-reports-plugin to
 3.9.0 for Airlock

- Bump maven-project-info-reports-plugin from 3.6.2 to 3.9.0 (MPIR-470 disables plugin processing on dependency POMs, stopping 12 unvetted third-party build-extension downloads during report generation and keeping license cells populated under Airlock).
- Update google-http-client-assembly/assembly.xml report paths from target/site/ to target/reports/ for Doxia 2.0.
- Pin maven-deploy-plugin 3.1.3 and maven-source-plugin 3.3.1 in parentless google-http-client-bom/pom.xml.
---
 google-http-client-assembly/assembly.xml | 18 +++++++++---------
 google-http-client-bom/pom.xml           | 10 ++++++++++
 pom.xml                                  |  2 +-
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/google-http-client-assembly/assembly.xml b/google-http-client-assembly/assembly.xml
index 5e8a4f708..d0b1b9148 100644
--- a/google-http-client-assembly/assembly.xml
+++ b/google-http-client-assembly/assembly.xml
@@ -88,48 +88,48 @@
     </file>
     <!-- dependencies.html -->
     <file>
-      <source>../google-http-client/target/site/dependencies.html</source>
+      <source>../google-http-client/target/reports/dependencies.html</source>
       <destName>google-http-client-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
     <file>
-      <source>../google-http-client-android/target/site/dependencies.html</source>
+      <source>../google-http-client-android/target/reports/dependencies.html</source>
       <destName>google-http-client-android-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
     <file>
-      <source>../google-http-client-apache-v2/target/site/dependencies.html</source>
+      <source>../google-http-client-apache-v2/target/reports/dependencies.html</source>
       <destName>google-http-client-apache-v2-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
     <file>
-      <source>../google-http-client-gson/target/site/dependencies.html</source>
+      <source>../google-http-client-gson/target/reports/dependencies.html</source>
       <destName>google-http-client-gson-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
     <file>
-      <source>../google-http-client-jackson2/target/site/dependencies.html</source>
+      <source>../google-http-client-jackson2/target/reports/dependencies.html</source>
       <destName>google-http-client-jackson2-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
     <file>
-      <source>../google-http-client-protobuf/target/site/dependencies.html</source>
+      <source>../google-http-client-protobuf/target/reports/dependencies.html</source>
       <destName>google-http-client-protobuf-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
     <file>
-      <source>../google-http-client-xml/target/site/dependencies.html</source>
+      <source>../google-http-client-xml/target/reports/dependencies.html</source>
       <destName>google-http-client-xml-dependencies.html</destName>
       <outputDirectory>google-http-java-client/dependencies</outputDirectory>
     </file>
   </files>
   <fileSets>
     <fileSet>
-      <directory>target/site/css</directory>
+      <directory>target/reports/css</directory>
       <outputDirectory>google-http-java-client/dependencies/css</outputDirectory>
     </fileSet>
     <fileSet>
-      <directory>target/site/images</directory>
+      <directory>target/reports/images</directory>
       <outputDirectory>google-http-java-client/dependencies/images</outputDirectory>
     </fileSet>
     <fileSet>
diff --git a/google-http-client-bom/pom.xml b/google-http-client-bom/pom.xml
index fe0957e78..6bff43479 100644
--- a/google-http-client-bom/pom.xml
+++ b/google-http-client-bom/pom.xml
@@ -134,6 +134,16 @@
       </plugins>
     </pluginManagement>
     <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-deploy-plugin</artifactId>
+        <version>3.1.3</version>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-source-plugin</artifactId>
+        <version>3.3.1</version>
+      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-javadoc-plugin</artifactId>
diff --git a/pom.xml b/pom.xml
index 36bf160f3..f4b499f84 100644
--- a/pom.xml
+++ b/pom.xml
@@ -435,7 +435,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-project-info-reports-plugin</artifactId>
-          <version>3.6.2</version>
+          <version>3.9.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From 05f56b6911d1cbf2ec8ab65080208b3c52f7901a Mon Sep 17 00:00:00 2001
From: Hongda Jiang <hongdaj@google.com>
Date: Fri, 13 Nov 2026 18:29:59 +0000
Subject: [PATCH 2/2] build(deps): remove the second
 maven-project-info-reports-plugin pin

The package-phase execution in build/plugins kept an explicit 3.6.2 version, which overrode the 3.9.0 pin in pluginManagement. Remove it so that pluginManagement is the only pin.
---
 pom.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f4b499f84..e11709c7c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -558,7 +558,6 @@
       <!-- Build the dependencies report at package time (needed for the assembly artifact). -->
       <plugin>
         <artifactId>maven-project-info-reports-plugin</artifactId>
-        <version>3.6.2</version>
         <executions>
           <execution>
             <goals>