Update Apache HttpClient5 and HttpCore5 (CVE-2025-27820)

CHANGELOG.md

@@ -18,6 +18,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.google.code.gson:gson` from 2.12.1 to 2.13.0 ([#17923](https://github.com/opensearch-project/OpenSearch/pull/17923))
 - Bump `com.github.spotbugs:spotbugs-annotations` from 4.9.0 to 4.9.3 ([#17922](https://github.com/opensearch-project/OpenSearch/pull/17922))
 - Bump `com.microsoft.azure:msal4j` from 1.18.0 to 1.20.0 ([#17925](https://github.com/opensearch-project/OpenSearch/pull/17925))
+- Update Apache HttpClient5 and HttpCore5 (CVE-2025-27820) ([#18152](https://github.com/opensearch-project/OpenSearch/pull/18152))
 - Bump `org.apache.commons:commons-collections4` from 4.4 to 4.5.0 ([#18101](https://github.com/opensearch-project/OpenSearch/pull/18101))
 
 ### Deprecated

client/rest/licenses/httpclient5-5.4.4.jar.sha1

@@ -0,0 +1 @@
+29aafa2d5ced55ed75dab37cce5e125fb06e54d8

client/rest/licenses/httpcore5-5.3.4.jar.sha1

@@ -0,0 +1 @@
+ea47f0fe6e00ffb07cec3a0cb1bb801b1a9cc353

client/rest/licenses/httpcore5-h2-5.3.4.jar.sha1

@@ -0,0 +1 @@
+3742a9a9ba3a5a0d45be230093b52a1302a561e2

client/rest/licenses/httpcore5-reactive-5.3.4.jar.sha1

@@ -0,0 +1 @@
+584f61333473c03458ccb38b7fa9a06b847b4046

client/rest/src/test/java/org/opensearch/client/RestClientSingleHostIntegTests.java

@@ -382,9 +382,6 @@ public void testHeaders() throws Exception {
             if (method.equals("HEAD") == false) {
                 standardHeaders.add("Content-length");
             }
-            if (method.equals("HEAD") == true || method.equals("GET") == true || method.equals("OPTIONS") == true) {
-                standardHeaders.add("Upgrade");
-            }
 
             final Header[] requestHeaders = RestClientTestUtil.randomHeaders(getRandom(), "Header");
             final int statusCode = randomStatusCode(getRandom());

client/sniffer/licenses/httpclient5-5.4.4.jar.sha1

@@ -0,0 +1 @@
+29aafa2d5ced55ed75dab37cce5e125fb06e54d8

client/sniffer/licenses/httpcore5-5.3.4.jar.sha1

@@ -0,0 +1 @@
+ea47f0fe6e00ffb07cec3a0cb1bb801b1a9cc353

gradle/libs.versions.toml

@@ -42,8 +42,8 @@ reactor_netty     = "1.2.4"
 reactor           = "3.5.20"
 
 # client dependencies
-httpclient5       = "5.4.1"
-httpcore5         = "5.3.2"
+httpclient5       = "5.4.4"
+httpcore5         = "5.3.4"
 httpclient        = "4.5.14"
 httpcore          = "4.4.16"
 httpasyncclient   = "4.1.5"