hive HIVE-28164: Remove log4j transitive dependency

What changes were proposed in this pull request?

There are dependency like accumulo and slf4j bringing log4j vulnerable jars in dependency tree. There are few dependencies also which don't appear in dependecy tree but are bringing old and vulnerable log4j. This can be observed in local m2 repo cache.

Why are the changes needed?

For CVE's and security reasons.

Does this PR introduce any user-facing change?

NO

Is the change a dependency upgrade?

Yes, here is new dependency tree: new-dependency-tree.txt

How was this patch tested?

Will see the UT from CI

Mar 29 '24 11:03 Aggarwal-Raghav

@zabetak, if you have bandwidth can you please review and provide your inputs on this?

Apr 02 '24 07:04 Aggarwal-Raghav

Apologies for the late response, Have updated the PR with suggested changes. I have created a new enforcer execution step to search for transitive dependencies of log4j. The scope of this PR is to only exclude log4j.

Apr 26 '24 11:04 Aggarwal-Raghav

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

Apr 26 '24 16:04 sonarqubecloud[bot]

@zabetak , can you please help with review?

May 22 '24 15:05 Aggarwal-Raghav

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

Jun 18 '24 13:06 sonarqubecloud[bot]

@zabetak , can you please re-review it, if you have the bandwidth

Aug 04 '24 05:08 Aggarwal-Raghav

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Feel free to reach out on the [email protected] list if the patch is in need of reviews.

Oct 04 '24 00:10 github-actions[bot]

I forgot about this issue. I will take a a look now.

Oct 07 '24 07:10 zabetak

Thanks @zabetak , for the review. your insights are always appreciated. I will address the review comments :-)

Oct 08 '24 15:10 Aggarwal-Raghav

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Oct 15 '24 05:10 sonarqubecloud[bot]

@zabetak, have updated the PR, can you please review?

Oct 15 '24 07:10 Aggarwal-Raghav