spark-3.5-scala-2.12/3.5.3-r0: cve remediation

[octo-sts]

spark-3.5-scala-2.12/3.5.3-r0: fix GHSA-cfxw-4h78-h7fw/GHSA-pr98-23f8-jwxv/

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/spark-3.5-scala-2.12.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: ```
[ERROR] Rule 3: org.codehaus.mojo.extraenforcer.dependencies.EnforceBytecodeVersion failed with message:
[ERROR] Found Banned Dependency: ch.qos.logback:logback-core:jar:1.5.13

• Error Category: Dependency

• Failure Point: Maven enforcer plugin dependency check during build

• Root Cause Analysis: The build is failing because it detected a banned dependency (logback-core 1.5.13) that likely has bytecode compatibility issues with the project requirements.

• Suggested Fix:
1. Add an exclusion for logback-core in the pom.xml:
```xml
<exclusions>
  <exclusion>
    <groupId>ch.qos.logback</groupId>
    <artifactId>logback-core</artifactId>
  </exclusion>
</exclusions>

2. Or explicitly declare a compatible version of logback-core:

<dependency>
  <groupId>ch.qos.logback</groupId>
  <artifactId>logback-core</artifactId>
  <version>1.2.12</version> <!-- Use compatible version -->
</dependency>

• Explanation: The Maven enforcer plugin is blocking the build because logback-core 1.5.13 may contain bytecode incompatible with the project's Java version requirements. Using an older stable version or excluding it should resolve the compatibility issue.

• Additional Notes:

• Logback is a logging framework dependency
• Version 1.5.13 is quite recent and may have Java 11+ bytecode
• The project may require Java 8 compatibility
• Check transitive dependencies to find what's pulling in logback

• References:

• https://logback.qos.ch/download.html
• https://github.com/apache/spark/blob/master/pom.xml
• https://maven.apache.org/enforcer/maven-enforcer-plugin/