Другая опция состоит в том, чтобы использовать ограничение зависимости: https://docs.gradle.org/current/userguide/managing_transitive_dependencies.html#sec:dependency_constraints

dependencies {
    implementation 'org.apache.httpcomponents:httpclient'
    constraints {
        implementation('org.apache.httpcomponents:httpclient:4.5.3') {
            because 'previous versions have a bug impacting this application'
        }
        implementation('commons-codec:commons-codec:1.11') {
            because 'version 1.9 pulled from httpclient has bugs affecting this application'
        }
    }
}