From 884f9c863cf5c46800bb5d9d068b960bc32ab447 Mon Sep 17 00:00:00 2001
From: PhongChuong <phong.hoa.chuong@gmail.com>
Date: Wed, 12 Mar 2025 11:45:46 -0400
Subject: [PATCH 1/4] deps: exclude io.netty:netty-common from
 org.apache.arrow:arrow-memory-netty

---
 google-cloud-bigquery/pom.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/google-cloud-bigquery/pom.xml b/google-cloud-bigquery/pom.xml
index becf16cde..178ede52f 100644
--- a/google-cloud-bigquery/pom.xml
+++ b/google-cloud-bigquery/pom.xml
@@ -116,6 +116,16 @@
     <dependency>
       <groupId>org.apache.arrow</groupId>
       <artifactId>arrow-memory-netty</artifactId>
+      <!--
+      Due to JDK8 requirement, we are forced to use arrow version below v18
+      which has io.netty:netty-common a dep. and its vulnerabilities
+      -->
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-common</artifactId>
+        </exclusion>
+      </exclusions>
       <scope>runtime</scope>
     </dependency>
 

From a80327e08c878496f4c277111575342115b3df96 Mon Sep 17 00:00:00 2001
From: PhongChuong <phong.hoa.chuong@gmail.com>
Date: Wed, 12 Mar 2025 14:40:28 -0400
Subject: [PATCH 2/4] use dep version override instead of exclusion

---
 google-cloud-bigquery/pom.xml | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/google-cloud-bigquery/pom.xml b/google-cloud-bigquery/pom.xml
index 178ede52f..02c6c57ef 100644
--- a/google-cloud-bigquery/pom.xml
+++ b/google-cloud-bigquery/pom.xml
@@ -15,6 +15,7 @@
   </parent>
   <properties>
     <site.installationModule>google-cloud-bigquery</site.installationModule>
+    <netty.version>4.1.118.Final</netty.version>
   </properties>
   <dependencies>
     <dependency>
@@ -116,16 +117,22 @@
     <dependency>
       <groupId>org.apache.arrow</groupId>
       <artifactId>arrow-memory-netty</artifactId>
-      <!--
-      Due to JDK8 requirement, we are forced to use arrow version below v18
-      which has io.netty:netty-common a dep. and its vulnerabilities
-      -->
-      <exclusions>
-        <exclusion>
-          <groupId>io.netty</groupId>
-          <artifactId>netty-common</artifactId>
-        </exclusion>
-      </exclusions>
+      <scope>runtime</scope>
+    </dependency>
+    <!--
+    Define io.netty versions to override org.apache.arrow:arrow-memory-netty
+    transitive dependency versions which contains vulnerabilities.
+    -->
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-common</artifactId>
+      <version>${netty.version}</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-buffer</artifactId>
+      <version>${netty.version}</version>
       <scope>runtime</scope>
     </dependency>
 

From 1bc8ad98321cfb99f9c198ccfcf3477558164328 Mon Sep 17 00:00:00 2001
From: PhongChuong <phong.hoa.chuong@gmail.com>
Date: Wed, 12 Mar 2025 14:49:12 -0400
Subject: [PATCH 3/4] use dep version override instead of exclusion

---
 google-cloud-bigquery/pom.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/google-cloud-bigquery/pom.xml b/google-cloud-bigquery/pom.xml
index 02c6c57ef..9e77999e8 100644
--- a/google-cloud-bigquery/pom.xml
+++ b/google-cloud-bigquery/pom.xml
@@ -117,6 +117,20 @@
     <dependency>
       <groupId>org.apache.arrow</groupId>
       <artifactId>arrow-memory-netty</artifactId>
+      <!--
+      Due to JDK8 requirement, we are forced to use arrow version below v18
+      which has io.netty:netty-common a dep. and its vulnerabilities
+      -->
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-common</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-buffer</artifactId>
+        </exclusion>
+      </exclusions>
       <scope>runtime</scope>
     </dependency>
     <!--

From de18e5b3734639d9fbbf8a96681900b8b592bbfd Mon Sep 17 00:00:00 2001
From: PhongChuong <phong.hoa.chuong@gmail.com>
Date: Wed, 12 Mar 2025 15:00:45 -0400
Subject: [PATCH 4/4] ignoredUnusedDeclaredDependencies

---
 pom.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pom.xml b/pom.xml
index a9db710d7..6acbe6622 100644
--- a/pom.xml
+++ b/pom.xml
@@ -168,6 +168,8 @@
         <artifactId>maven-dependency-plugin</artifactId>
         <configuration>
           <ignoredUnusedDeclaredDependencies>
+            <ignoredUnusedDeclaredDependency>io.netty:netty-buffer</ignoredUnusedDeclaredDependency>
+            <ignoredUnusedDeclaredDependency>io.netty:netty-common</ignoredUnusedDeclaredDependency>
             <ignoredUnusedDeclaredDependency>org.apache.arrow:arrow-memory-netty</ignoredUnusedDeclaredDependency>
           </ignoredUnusedDeclaredDependencies>
         </configuration>