tez/0.10.4-r1: cve remediation

[octo-sts]

tez/0.10.4-r1: fix GHSA-mfj5-cf8g-g2fv

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/tez.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

Based on the build output, I'll analyze the situation:

• Detected Error: These are actually warnings, not errors. The main message is:

[WARNING] The following patterns were never triggered in this artifact exclusion filter:
o  'org.apache.hadoop:hadoop-hdfs'

• Error Category: Configuration/Dependency

• Failure Point: Maven build dependency exclusion filters

• Root Cause Analysis: The build is actually successful (BUILD SUCCESS) but shows warnings about unused exclusion patterns for hadoop-hdfs dependencies. This suggests the build configuration is trying to exclude dependencies that aren't present in the first place.

• Suggested Fix:

1. Review and update the patches.yaml file to remove the unnecessary exclusion pattern:

- path: "pom.xml"
  find: "<exclusion>\s*<groupId>org\.apache\.hadoop</groupId>\s*<artifactId>hadoop-hdfs</artifactId>\s*</exclusion>"
  replace: ""

• Explanation: The warnings indicate that the build configuration is trying to exclude hadoop-hdfs dependencies that aren't actually present in the dependency tree. Since the build succeeds and these are just warnings, removing the unnecessary exclusion patterns will clean up the build output without affecting functionality.

• Additional Notes:

• The build completes successfully despite these warnings
• All modules build correctly
• Total build time was 1:12 hours
• Package size is approximately 84MB
• The runtime dependency on openjdk-8-default-jvm is correctly specified

• References:

• Apache Tez Documentation: https://tez.apache.org/releases/0.10.4/tez-api-javadocs/index.html
• Maven Dependency Exclusion Documentation: https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html