(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [#10457] fix(hive): Exclude vulnerable log4j transitive deps from hive-metastore-common (#11414) (#11423)

[yuqi4733]

This is an automated email from the ASF dual-hosted git repository.

yuqi1129 pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new c3eaa317dd [Cherry-pick to branch-1.3] [#10457] fix(hive): Exclude 
vulnerable log4j transitive deps from hive-metastore-common (#11414) (#11423)
c3eaa317dd is described below

commit c3eaa317ddb95b9540dbbac08ef6e6d3511890af
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Thu Jun 4 15:55:12 2026 +0800

    [Cherry-pick to branch-1.3] [#10457] fix(hive): Exclude vulnerable log4j 
transitive deps from hive-metastore-common (#11414) (#11423)
    
    **Cherry-pick Information:**
    - Original commit: 7198460f460ab3dfad958b394c46b52621b7914e
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Co-authored-by: Bharath Krishna <bmur...@roku.com>
---
 catalogs/hive-metastore-common/build.gradle.kts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/catalogs/hive-metastore-common/build.gradle.kts 
b/catalogs/hive-metastore-common/build.gradle.kts
index e4bde6e3e6..9e2c387363 100644
--- a/catalogs/hive-metastore-common/build.gradle.kts
+++ b/catalogs/hive-metastore-common/build.gradle.kts
@@ -34,7 +34,10 @@ dependencies {
   compileOnly(project(":common"))
   compileOnly(project(":core"))
 
-  compileOnly(libs.hive2.metastore)
+  compileOnly(libs.hive2.metastore) {
+    exclude(group = "log4j")
+    exclude(group = "org.apache.logging.log4j")
+  }
   compileOnly(libs.immutables.value)
   compileOnly(libs.lombok)
   compileOnly(libs.caffeine)