Fix parquet-avro vulnerability in io expansion service

[derrickaw]

Fixes CVE-2025-30065

./gradlew :sdks:java:io:expansion-service:dependencies --configuration runtimeClasspath | grep parquet-avro

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[github-actions]

Assigning reviewers. If you would like to opt out of this review, comment assign to next reviewer:

R: @ahmedabu98 for label java.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[github-actions]

Reminder, please take a look at this pr: @ahmedabu98

[github-actions]

Assigning new set of reviewers because Pr has gone too long without review. If you would like to opt out of this review, comment assign to next reviewer:

R: @robertwb for label java.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

[damccorm]

Do you know which dependenc(y|ies) currently cause parquet-avro to be installed? I'm in favor of the change, but it would be good for us to know this so that we can respond once the dependency is fixed. Once we figure out that dependency FOO is causing the lower version of parquet-avro to be installed, we should add a couple comments:

1. A comment here mentioning that this can be removed once that dependency is upgraded and ./gradlew :sdks:java:io:expansion-service:dependencies --configuration runtimeClasspath | grep parquet-avro shows no entries
2. A comment next to dependency FOO mentioning that this should be removed once that is upgraded to a version with a higher parquet-avro dependency.

Both should link to a tracking issue with context (e.g. like b287985 does)

[derrickaw]

Thanks. Its covered now by another PR - #35037