deps: exclude io.netty:netty-common from org.apache.arrow:arrow-memor… (#3715)

* deps: exclude io.netty:netty-common from org.apache.arrow:arrow-memory-netty

* use dep version override instead of exclusion

* use dep version override instead of exclusion

* ignoredUnusedDeclaredDependencies

Author: PhongChuong

google-cloud-bigquery/pom.xml

@@ -15,6 +15,7 @@
   </parent>
   <properties>
     <site.installationModule>google-cloud-bigquery</site.installationModule>
+    <netty.version>4.1.118.Final</netty.version>
   </properties>
   <dependencies>
     <dependency>
@@ -116,6 +117,36 @@
     <dependency>
       <groupId>org.apache.arrow</groupId>
       <artifactId>arrow-memory-netty</artifactId>
+      <!--
+      Due to JDK8 requirement, we are forced to use arrow version below v18
+      which has io.netty:netty-common a dep. and its vulnerabilities
+      -->
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-common</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-buffer</artifactId>
+        </exclusion>
+      </exclusions>
+      <scope>runtime</scope>
+    </dependency>
+    <!--
+    Define io.netty versions to override org.apache.arrow:arrow-memory-netty
+    transitive dependency versions which contains vulnerabilities.
+    -->
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-common</artifactId>
+      <version>${netty.version}</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-buffer</artifactId>
+      <version>${netty.version}</version>
       <scope>runtime</scope>
     </dependency>
 

pom.xml

@@ -168,6 +168,8 @@
         <artifactId>maven-dependency-plugin</artifactId>
         <configuration>
           <ignoredUnusedDeclaredDependencies>
+            <ignoredUnusedDeclaredDependency>io.netty:netty-buffer</ignoredUnusedDeclaredDependency>
+            <ignoredUnusedDeclaredDependency>io.netty:netty-common</ignoredUnusedDeclaredDependency>
             <ignoredUnusedDeclaredDependency>org.apache.arrow:arrow-memory-netty</ignoredUnusedDeclaredDependency>
           </ignoredUnusedDeclaredDependencies>
         </configuration>