fix(deps): update dependency commons-codec:commons-codec to v1.20.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
commons-codec:commons-codec (source)	1.18.0 -> 1.20.0

---

Release Notes

apache/commons-codec (commons-codec:commons-codec)

v1.20.0

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.20.0.

The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

---

Configuration

📅 Schedule: Branch creation - "every 3 weeks on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vlsi]

Is there a real reason to use commons-codec?
We should rather drop the dependency to avoid CVEs

[vlsi]

Ah, it is used in transitive dependencies:

+--- com.google.http-client:google-http-client-apache-v2 -> 1.47.1
|    +--- com.google.http-client:google-http-client:1.47.1
|    |    +--- org.apache.httpcomponents:httpclient:4.5.14
|    |    |    +--- org.apache.httpcomponents:httpcore:4.4.16
|    |    |    +--- commons-logging:commons-logging:1.2
|    |    |    \--- commons-codec:commons-codec:1.11 -> 1.18.0

---

Unfortunately, httpclient4 is not supported, so there's no way to remove commons-codec dependency while http-client 5 already has removed commons-codec dependency.

[loosebazooka]

there is a v5 pathway: https://github.com/googleapis/google-http-java-client/tree/main/google-http-client-apache-v5 , probably going to need to look into how to use that instead.

[loosebazooka]

it seems like ideally we would just move off of google-http-client?

[vlsi]

If you are ok to move off google-http-client, then it might be a workable solution as well

[loosebazooka]

Google-http-client was convenient at the time (especially for oidc). But we have no attachment to it.

I have a half done branch just using apache http client directly. I'll see how that goes