httpclient:4.5.2 comes from org.opendaylight.odlparent. Hence we have to wait opendaylight to fix this issue.

                <dependency>
                        <!-- Required for launching the feature tests -->
                        <groupId>org.opendaylight.odlparent</groupId>
                        <artifactId>features-test</artifactId>
                        <version>${odl.commons.opendaylight.version}</version>
                        <scope>test</scope>
                </dependency>

Takamunes-MacBook-Pro:appc tkcho224$ git grep org.opendaylight.odlparent

appc-config/appc-config-adaptor/features/pom.xml:            <groupId>org.opendaylight.odlparent</groupId>
appc-config/appc-config-audit/features/pom.xml:                 <groupId>org.opendaylight.odlparent</groupId>
appc-config/appc-config-params/features/pom.xml:                        <groupId>org.opendaylight.odlparent</groupId>
appc-config/appc-data-services/features/pom.xml:                        <groupId>org.opendaylight.odlparent</groupId>
appc-config/appc-encryption-tool/features/pom.xml:            <groupId>org.opendaylight.odlparent</groupId>
appc-config/appc-flow-controller/features/pom.xml:            <groupId>org.opendaylight.odlparent</groupId>
appc-directed-graph/dg-loader/features/pom.xml:            <groupId>org.opendaylight.odlparent</groupId>
appc-inbound/appc-artifact-handler/features/pom.xml:                    <groupId>org.opendaylight.odlparent</groupId>
appc-inbound/appc-design-services/features/pom.xml:                     <groupId>org.opendaylight.odlparent</groupId>
appc-inbound/appc-interfaces-service/features/pom.xml:            <groupId>org.opendaylight.odlparent</groupId>
appc-outbound/appc-aai-client/features/pom.xml:                 <groupId>org.opendaylight.odlparent</groupId>

=== from security vulnerability report NEXUS IQ

httpclient-4.5.2.jar located at appc-inbound/appc-interfaces-service/installer/target/appc-interfaces-service-1.3.0-SNAPSHOT.zip/appc-interfaces-service/appc-interfaces-service-1.3.0-SNAPSHOT.zip/system/org/apache/httpcomponents/httpclient/4.5.2

httpclient-4.5.2.jar located at appc-inbound/appc-interfaces-service/installer/target/assembly/system/org/apache/httpcomponents/httpclient/4.5.2

httpclient-4.5.2.jar located at appc-outbound/appc-aai-client/installer/target/appc-aai-client-1.3.0-SNAPSHOT.zip/appc-aai-client/appc-aai-client-1.3.0-SNAPSHOT.zip/system/org/apache/httpcomponents/httpclient/4.5.2

httpclient-4.5.2.jar located at appc-outbound/appc-aai-client/installer/target/assembly/system/org/apache/httpcomponents/httpclient/4.5.2

Dependency org.apache.httpcomponents:httpclient:jar:4.5.2 located at Module org.onap.appc:appc-aai-client-features:jar:1.3.0-SNAPSHOT

Dependency org.apache.httpcomponents:httpclient:jar:4.5.2 located at Module org.onap.appc:appc-aai-client-installer:pom:1.3.0-SNAPSHOT

Dependency org.apache.httpcomponents:httpclient:jar:4.5.2 located at Module org.onap.appc:appc-aai-client-provider:bundle:1.3.0-SNAPSHOT

Dependency org.apache.httpcomponents:httpclient:jar:4.5.2 located at Module org.onap.appc:appc-interfaces-service-bundle:bundle:1.3.0-SNAPSHOT

Dependency org.apache.httpcomponents:httpclient:jar:4.5.2 located at Module org.onap.appc:appc-interfaces-service-features:jar:1.3.0-SNAPSHOT

Dependency org.apache.httpcomponents:httpclient:jar:4.5.2 located at Module org.onap.appc:appc-interfaces-service-installer:pom:1.3.0-SNAPSHOT