bharos opened a new pull request, #11414: URL: https://github.com/apache/gravitino/pull/11414
### What changes were proposed in this pull request? Exclude `log4j` and `org.apache.logging.log4j` transitive dependencies from the `compileOnly(libs.hive2.metastore)` declaration in `catalogs/hive-metastore-common/build.gradle.kts`. ### Why are the changes needed? PR #10465 added comprehensive dependency exclusions (including log4j) to `hive-metastore2-libs` and `hive-metastore3-libs`, but the same `hive2.metastore` dependency in `hive-metastore-common` was left without log4j exclusions. This causes `log4j-core:2.6.2` (CVE-2021-44228) and `log4j:1.2.17` to appear on the compile classpath via transitive resolution through `hive-metastore:2.3.9 → hive-serde → hive-common → log4j-1.2-api → log4j-core`. While `compileOnly` dependencies do not ship in the distribution, excluding vulnerable log4j ensures consistent hygiene across all metastore Gradle files and prevents any accidental classpath leakage. ### Does this PR introduce any user-facing change? No. ### How was this patch tested? - `./gradlew :catalogs:hive-metastore-common:build` — BUILD SUCCESSFUL - `./gradlew :catalogs:hive-metastore-common:spotlessCheck` — passed - Verified the exclusion pattern matches `hive-metastore2-libs` and `hive-metastore3-libs` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
