fix(OPENFRAM-005-14): CU-86akbhhb3 pinot-java-client dependency exclusions incomplete relative to documented managed exclusion set

[flamingo]

Closes findings from rule OPENFRAM-005-14 — pinot-java-client dependency exclusions incomplete relative to documented managed exclusion set.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🔴 55 low — review closely	pinot-java-client dependency exclusions incomplete relative to documented managed exclusion set	pom.xml:88

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: c1688cba-c9bc-481b-b917-2b7f45403ab4

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhb3 OpenFrame config secret and property fixes (6 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🟠 pinot-java-client dependency exclusions incomplete relative to documented managed exclusion set

In the pinot-java-client dependency block (root <dependencies> section, around line 88), added <exclusion> entries for org.webjars:swagger-ui, com.sun.jersey:*, com.sun.jersey.contribs:*, org.glassfish.jersey.core:*, org.apache.helix:*, org.apache.zookeeper:*, and org.codehaus.groovy:*, alongside the existing org.apache.logging.log4j:* and org.slf4j:slf4j-log4j12 exclusions, to align with the OPENFRAM-005-14 documented exclusion set. The exact groupIds for the swagger-ui and Jersey artifacts (webjars vs. other packaging, jersey 1.x vs. glassfish jersey 2.x/3.x coordinates) were inferred from common Pinot transitive dependency trees and were not verified against the actual pinot-java-client:1.2.0 dependency tree, so the specific artifactIds/groupIds may need adjustment (e.g. via mvn dependency:tree) to precisely match what that version actually pulls in; a complete fix would confirm these coordinates against the real resolved tree.

🤖 Prompt for AI agents

In pom.xml around line 88, review and complete this code-review fix: pinot-java-client dependency exclusions incomplete relative to documented managed exclusion set.
What the draft fix changed: In the `pinot-java-client` dependency block (root `<dependencies>` section, around line 88), added `<exclusion>` entries for `org.webjars:swagger-ui`, `com.sun.jersey:*`, `com.sun.jersey.contribs:*`, `org.glassfish.jersey.core:*`, `org.apache.helix:*`, `org.apache.zookeeper:*`, and `org.codehaus.groovy:*`, alongside the existing `org.apache.logging.log4j:*` and `org.slf4j:slf4j-log4j12` exclusions, to align with the OPENFRAM-005-14 documented exclusion set. The exact groupIds for the swagger-ui and Jersey artifacts (webjars vs. other packaging, jersey 1.x vs. glassfish jersey 2.x/3.x coordinates) were inferred from common Pinot transitive dependency trees and were not verified against the actual `pinot-java-client:1.2.0` dependency tree, so the specific artifactIds/groupIds may need adjustment (e.g. via `mvn dependency:tree`) to precisely match what that version actually pulls in; a complete fix would confirm these coordinates against the real resolved tree.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer