chroe(deps): replace dependencies without license for Airlock onboarding

google-auth-library-java/pom.xml

@@ -398,22 +398,6 @@
           </execution>
         </executions>
       </plugin>
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>clirr-maven-plugin</artifactId>
-        <configuration>
-          <ignoredDifferencesFile>clirr-ignored-differences.xml
-          </ignoredDifferencesFile>
-          <logResults>true</logResults>
-        </configuration>
-        <executions>
-          <execution>
-            <goals>
-              <goal>check</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-resources-plugin</artifactId>
@@ -437,6 +421,36 @@
   </build>
 
   <profiles>
+    <profile>
+      <!-- CLIRR in a profile with the same id as java-shared-config, so the release scripts
+           (-P=-clirr-compatibility-check) do not resolve clirr-maven-plugin 2.8. Its dependency
+           tree (plexus-components 1.1.4, classworlds 1.1-alpha-2, ...) is not in Airlock
+           (b/568717591). The JDK activation keeps CLIRR on by default for CI. -->
+      <id>clirr-compatibility-check</id>
+      <activation>
+        <jdk>[1.8,)</jdk>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>clirr-maven-plugin</artifactId>
+            <configuration>
+              <ignoredDifferencesFile>clirr-ignored-differences.xml
+              </ignoredDifferencesFile>
+              <logResults>true</logResults>
+            </configuration>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>check</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
     <profile>
       <id>slf4j2x-test</id>
       <!--  This profile is for logging test only, use instead of the default slf4j2x  -->

java-cloud-bom/dashboard/pom.xml

@@ -6,7 +6,7 @@
   <parent>
     <groupId>com.google.cloud.tools</groupId>
     <artifactId>dependencies-parent</artifactId>
-    <version>1.5.15</version>
+    <version>1.5.16</version>
     <relativePath/>
   </parent>
   <artifactId>google-cloud-bom-dashboard</artifactId>
@@ -118,7 +118,7 @@
     <dependency>
       <groupId>com.google.cloud.tools</groupId>
       <artifactId>dependencies</artifactId>
-      <version>1.5.15</version>
+      <version>1.5.16</version>
     </dependency>
     <dependency>
       <groupId>com.google.code.findbugs</groupId>

java-cloud-bom/libraries-release-data/pom.xml

@@ -13,7 +13,7 @@
         <dependency>
             <groupId>com.google.cloud.tools</groupId>
             <artifactId>dependencies</artifactId>
-            <version>1.5.15</version>
+            <version>1.5.16</version>
             <scope>compile</scope>
         </dependency>
         <dependency>

java-cloud-bom/pom.xml

@@ -44,11 +44,25 @@
     <module>release-note-generation</module>
     <module>libraries-release-data</module>
     <module>tests</module>
-    <module>tests/dependency-convergence</module>
+    <!-- tests/dependency-convergence is not in the reactor. It depends on every artifact of the
+         latest libraries-bom, so a release resolves the whole release train it just published.
+         Under Airlock-only resolution that fails until Airlock imports every new 1P artifact
+         (b/568717591). CI runs it on its own: .kokoro/dashboard.sh (dependency-convergence-check). -->
     <module>tests/validate-bom</module>
   </modules>
 
   <build>
+    <pluginManagement>
+      <plugins>
+        <!-- Pin surefire. Without a pin, Maven uses its default binding (2.17 on Maven 3.9.12), which
+             pulls classworlds:1.1 and classworlds:1.1-alpha-2. Those are not in Airlock (b/568717591). -->
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-surefire-plugin</artifactId>
+          <version>3.5.3</version>
+        </plugin>
+      </plugins>
+    </pluginManagement>
     <plugins>
       <plugin>
         <!-- This root pom.xml is not referenced by the BOMs and no need to

java-cloud-bom/release-note-generation/pom.xml

@@ -25,7 +25,7 @@
 		<dependency>
 			<groupId>com.google.cloud.tools</groupId>
 			<artifactId>dependencies</artifactId>
-			<version>1.5.15</version>
+			<version>1.5.16</version>
 		</dependency>
 		<dependency>
 			<groupId>junit</groupId>

java-cloud-bom/tests/pom.xml

@@ -54,7 +54,7 @@
     <dependency>
       <groupId>com.google.cloud.tools</groupId>
       <artifactId>dependencies</artifactId>
-      <version>1.5.15</version>
+      <version>1.5.16</version>
       <scope>test</scope>
     </dependency>
     <dependency>

java-cloud-bom/tests/validate-bom/pom.xml

@@ -58,7 +58,7 @@
     <dependency>
       <groupId>com.google.cloud.tools</groupId>
       <artifactId>dependencies</artifactId>
-      <version>1.5.15</version>
+      <version>1.5.16</version>
     </dependency>
     <dependency>
       <groupId>org.apache.maven.resolver</groupId>

java-samples/native-image-sample/pom.xml

@@ -18,7 +18,7 @@
             <dependency>
                 <groupId>com.google.cloud</groupId>
                 <artifactId>libraries-bom</artifactId>
-                <version>26.86.0</version>
+                <version>26.90.0</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>

java-spanner/samples/snippets/pom.xml

@@ -34,7 +34,7 @@
       <dependency>
         <groupId>com.google.cloud</groupId>
         <artifactId>libraries-bom</artifactId>
-        <version>26.80.0</version>
+        <version>26.90.0</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml

@@ -37,7 +37,7 @@
     <dependency>
       <groupId>com.google.cloud.tools</groupId>
       <artifactId>dependencies</artifactId>
-      <version>1.5.13</version>
+      <version>1.5.16</version>
       <scope>test</scope>
     </dependency>
     <dependency>

sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml

@@ -72,7 +72,7 @@
     <dependency>
       <groupId>com.google.cloud.tools</groupId>
       <artifactId>dependencies</artifactId>
-      <version>1.5.13</version>
+      <version>1.5.16</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>

sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 package com.google.cloud;
 
 import static com.google.common.base.Preconditions.checkArgument;
@@ -6,6 +22,7 @@
 import com.google.cloud.tools.opensource.classpath.DependencyMediation;
 import com.google.cloud.tools.opensource.dependencies.Bom;
 import com.google.cloud.tools.opensource.dependencies.MavenRepositoryException;
+import com.google.common.collect.ImmutableSet;
 import java.nio.file.Paths;
 import java.util.HashSet;
 import java.util.List;
@@ -18,6 +35,11 @@
  * A utility class to check unmanaged dependencies in BOM.
  */
 public class UnmanagedDependencyCheck {
+  // Artifacts listed in gapic-libraries-bom whose third-party dependencies (e.g. logback)
+  // are intentionally not managed by google-cloud-shared-dependencies.
+  private static final ImmutableSet<String> BOM_SKIP_ARTIFACT_IDS =
+      ImmutableSet.of("google-cloud-logging-logback", "google-cloud-contrib");
+
   // Regex of handwritten artifacts.
   // There are customized artifacts defined in gapic-bom and handwritten libraries,
   // e.g., firestore and datastore, add entries in regex to exclude these artifacts.
@@ -73,8 +95,12 @@ private static Set<String> getManagedDependencies(String projectBomPath)
   private static Set<String> getManagedDependenciesFromBom(Bom bom)
       throws InvalidVersionSpecificationException {
     Set<String> res = new HashSet<>();
+    List<Artifact> managedDependencies =
+        bom.getManagedDependencies().stream()
+            .filter(artifact -> !BOM_SKIP_ARTIFACT_IDS.contains(artifact.getArtifactId()))
+            .collect(Collectors.toList());
     new ClassPathBuilder()
-        .resolve(bom.getManagedDependencies(), false, DependencyMediation.MAVEN)
+        .resolve(managedDependencies, false, DependencyMediation.MAVEN)
         .getClassPath()
         .forEach(
             classPath -> {

sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 package com.google.cloud;
 
 import static com.google.common.truth.Truth.assertThat;
@@ -26,7 +42,7 @@ public void getUnmanagedDependencyFromGapicAndHandwrittenBomTest()
         UnmanagedDependencyCheck.getUnmanagedDependencies(
             "src/test/resources/shared-dependency-pom.xml",
             "src/test/resources/google-internal-artifact-test-case-pom.xml");
-    assertTrue(unManagedDependencies.isEmpty());
+    assertThat(unManagedDependencies).isEmpty();
   }
 
   @Test

sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/resources/google-internal-artifact-test-case-pom.xml

@@ -62,6 +62,11 @@
           <scope>import</scope>
           <type>pom</type>
         </dependency>
+        <dependency>
+          <groupId>com.google.cloud</groupId>
+          <artifactId>google-cloud-logging-logback</artifactId>
+          <version>0.132.0-alpha</version>
+        </dependency>
       </dependencies>
     </dependencyManagement>