The JAR file that Hudi Common depends on has vulnerabilities.

hudi common depends on `hbase-protocol-shaded-2.4.13.jar` and `htrace-core4-4.2.0-incubating.jar`
Among them, `hbase-protocol-shaded` also depends on ` htrace-core` .
The htrace-core dependency on jackson-databind has many vulnerabilities.


We want to exclude `jackson-databind ` using Maven's mechanism. However, these two JAR files are packaged using the Maven Shade Plugin, and there is no direct way to exclude them.

Does the community currently have a way to work around this issue, or is there a plan to fix this vulnerability?

Review the Maven Shade Plugin configuration that packages hbase-protocol-shaded-2.4.13.jar and htrace-core4-4.2.0-incubating.jar. Trace how htrace-core brings in jackson-databind, then determine whether the shaded artifacts can safely remove that dependency or require an upgrade. Done means documenting or implementing a supported way to eliminate the vulnerable dependency and verifying the resulting artifacts.

Written by the indexing model from the issue text.