geyanggang opened a new issue, #11051: URL: https://github.com/apache/gravitino/issues/11051
### What would you like to be improved? Apache Derby is transitively pulled into the runtime classpath of `hive-metastore2-libs` and `hive-metastore3-libs` through Hive Metastore dependencies. Derby is only needed as an embedded database backend for Hive Metastore in test environments — production deployments use MySQL or PostgreSQL as the HMS backend. Currently: - `hive-metastore2-libs` ships Derby 10.10.2.0 in its runtimeClasspath - `hive-metastore3-libs` ships Derby 10.14.1.0 in its runtimeClasspath These jars end up in the production distribution (`distribution/package/catalogs/hive/libs/`) unnecessarily, increasing the attack surface and distribution size. ### How should we improve? Exclude `org.apache.derby` from the Hive Metastore transitive dependencies in both modules. This is consistent with how other modules (`iceberg-common`, `hive-metastore-common`, `catalog-lakehouse-paimon`) already handle this dependency. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
