druid/GHSA-r7pg-v2c8-mfg3 advisory update (#8646)

* druid/GHSA-r7pg-v2c8-mfg3 advisory update

* Update druid.advisories.yaml timestamp 

Signed-off-by: jamie-albert <jamie.albert@chainguard.dev>

---------

Signed-off-by: jamie-albert <jamie.albert@chainguard.dev>
Co-authored-by: Debasish Biswas <debasishbsws.dev@gmail.com>

druid.advisories.yaml

@@ -374,6 +374,10 @@ advisories:
             componentType: java-archive
             componentLocation: /usr/share/java/druid/extensions/druid-avro-extensions/avro-1.11.3.jar
             scanner: grype
+      - timestamp: 2024-10-15T06:24:11Z
+        type: pending-upstream-fix
+        data:
+          note: 'The remaining avro dependency that gets flagged with this CVE is a transitive dependency that is part of the hadoop-client-runtime.jar and requires a fix from the upstream maintainers. '
 
   - id: CGA-h9pg-8x4v-69rh
     aliases: