Align http dependencies with elasticsearch-rest-client

Address the upstream issue [1] which is caused by the lack of upgrades
done in this change. While waiting for Elastic to potentially provide
shaded dependencies [1,2] for these, upgrade them herein still for now.
Meaning, do not consider trying [2] this time around either. Favor the
upgrade approach which is still simpler and likelier to succeed today.

Base these new versions on [3]'s dependencies, even though the issue
([1]) didn't fail the build as such for version 7.8.1 of the client.
This issue's fix starts becoming necessary from client versions 7.9.x,
as shown by the follow-up upgrade change to 7.9.0 which requires this.

The most downstream branch of gerrit to include this change determines
from which Gerrit version the Elasticsearch versions 7.9.x can be
supported.

Set HTTPCOMP_VERS to the earlier 4.5.2, to comply with Google's
currently deployed internal version.

[1] https://github.com/elastic/elasticsearch/issues/61664
[2] https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/java-rest-low-usage-shading.html
[3] https://search.maven.org/artifact/org.elasticsearch.client/elasticsearch-rest-client/7.8.1/jar

Change-Id: I1fc91bce95d9e8094c19ad4044bd08b6285524af

2 files changed, 13 insertions, 8 deletions

diff --git a/WORKSPACE b/WORKSPACE
index 9413b1668e..0f2733bc26 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -795,26 +795,30 @@ maven_jar(
     sha1 = "fd369423346b2f1525c413e33f8cf95b09c92cbd",
 )
 
-# Note that all of the following org.apache.httpcomponents have newer versions,
-# but 4.4.1 is the only version that is available for all of them.
-HTTPCOMP_VERS = "4.4.1"
+# Base the following org.apache.httpcomponents versions on what
+# elasticsearch-rest-client explicitly depends on, except for
+# commons-codec (non-http) which is not necessary yet. Note that
+# below httpcore version(s) differs from the HTTPCOMP_VERS range,
+# upstream: that specific dependency has no HTTPCOMP_VERS version
+# equivalent currently.
+HTTPCOMP_VERS = "4.5.2"
 
 maven_jar(
     name = "fluent-hc",
     artifact = "org.apache.httpcomponents:fluent-hc:" + HTTPCOMP_VERS,
-    sha1 = "96fb842b68a44cc640c661186828b60590c71261",
+    sha1 = "7bfdfa49de6d720ad3c8cedb6a5238eec564dfed",
 )
 
 maven_jar(
     name = "httpclient",
     artifact = "org.apache.httpcomponents:httpclient:" + HTTPCOMP_VERS,
-    sha1 = "016d0bc512222f1253ee6b64d389c84e22f697f0",
+    sha1 = "733db77aa8d9b2d68015189df76ab06304406e50",
 )
 
 maven_jar(
     name = "httpcore",
-    artifact = "org.apache.httpcomponents:httpcore:" + HTTPCOMP_VERS,
-    sha1 = "f5aa318bda4c6c8d688c9d00b90681dcd82ce636",
+    artifact = "org.apache.httpcomponents:httpcore:4.4.12",
+    sha1 = "21ebaf6d532bc350ba95bd81938fa5f0e511c132",
 )
 
 # Test-only dependencies below.
diff --git a/tools/nongoogle.bzl b/tools/nongoogle.bzl
index 19d4f54724..5165e09483 100644
--- a/tools/nongoogle.bzl
+++ b/tools/nongoogle.bzl
@@ -99,7 +99,8 @@ def declare_nongoogle_deps():
     )
 
     # When upgrading elasticsearch-rest-client, also upgrade httpcore-nio
-    # and httpasyncclient as necessary.
+    # and httpasyncclient as necessary. Consider also the other
+    # org.apache.httpcomponents dependencies in ../WORKSPACE.
     maven_jar(
         name = "elasticsearch-rest-client",
         artifact = "org.elasticsearch.client:elasticsearch-rest-client:7.8.1",