(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [#11899] fix(flink): exclude vulnerable log4j 2.x from hive-common compile classpath (#11898) (#11911)

[yuqi4733]

This is an automated email from the ASF dual-hosted git repository.

yuqi1129 pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new d6a3b20224 [Cherry-pick to branch-1.3] [#11899] fix(flink): exclude 
vulnerable log4j 2.x from hive-common compile classpath (#11898) (#11911)
d6a3b20224 is described below

commit d6a3b2022465e53bf54e31084b38ba0d0f94195a
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Jul 7 09:59:43 2026 +0800

    [Cherry-pick to branch-1.3] [#11899] fix(flink): exclude vulnerable log4j 
2.x from hive-common compile classpath (#11898) (#11911)
    
    **Cherry-pick Information:**
    - Original commit: 5bcfc167a4e5bb0f9e095e98c7d17276fe35453a
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Co-authored-by: Bharath Krishna <bmur...@roku.com>
---
 flink-connector/v1.18/flink/build.gradle.kts | 1 +
 flink-connector/v1.19/flink/build.gradle.kts | 1 +
 flink-connector/v1.20/flink/build.gradle.kts | 1 +
 3 files changed, 3 insertions(+)

diff --git a/flink-connector/v1.18/flink/build.gradle.kts 
b/flink-connector/v1.18/flink/build.gradle.kts
index 83841d02e7..2abe87eb5d 100644
--- a/flink-connector/v1.18/flink/build.gradle.kts
+++ b/flink-connector/v1.18/flink/build.gradle.kts
@@ -57,6 +57,7 @@ dependencies {
   compileOnly(libs.hive2.common) {
     exclude("org.eclipse.jetty.aggregate", "jetty-all")
     exclude("org.eclipse.jetty.orbit", "javax.servlet")
+    exclude("org.apache.logging.log4j")
   }
 
   testImplementation(project(":api"))
diff --git a/flink-connector/v1.19/flink/build.gradle.kts 
b/flink-connector/v1.19/flink/build.gradle.kts
index 755da86ada..09284443d3 100644
--- a/flink-connector/v1.19/flink/build.gradle.kts
+++ b/flink-connector/v1.19/flink/build.gradle.kts
@@ -57,6 +57,7 @@ dependencies {
   compileOnly(libs.hive2.common) {
     exclude("org.eclipse.jetty.aggregate", "jetty-all")
     exclude("org.eclipse.jetty.orbit", "javax.servlet")
+    exclude("org.apache.logging.log4j")
   }
 
   testImplementation(project(":api"))
diff --git a/flink-connector/v1.20/flink/build.gradle.kts 
b/flink-connector/v1.20/flink/build.gradle.kts
index 81e1c421d2..5d589f6e58 100644
--- a/flink-connector/v1.20/flink/build.gradle.kts
+++ b/flink-connector/v1.20/flink/build.gradle.kts
@@ -57,6 +57,7 @@ dependencies {
   compileOnly(libs.hive2.common) {
     exclude("org.eclipse.jetty.aggregate", "jetty-all")
     exclude("org.eclipse.jetty.orbit", "javax.servlet")
+    exclude("org.apache.logging.log4j")
   }
 
   testImplementation(project(":api"))