Merge branch 'gerrit/morpheus' into 'master'

 * [ASTERIXDB-3677][COMP] Fix nested star operators failure (MB-70076)
 * [NO ISSUE][HYR][NET] Upgrade gRPC to address Netty CVE (MB-70641)
 * [NO ISSUE][MISC] Update Log4j to 2.25.3 for CVE (MB-70643)
 * [NO ISSUE][*DB][EXT] Update Apache Hadoop -> 3.4.2 for CVE (MB-70644)

Change-Id: Ic7feef98087205543e831d44edd1d9acea5045cb

Author: mblow

asterixdb/asterix-algebra/src/main/java/org/apache/asterix/optimizer/rules/cbo/Stats.java

@@ -44,7 +44,7 @@
 import org.apache.asterix.optimizer.base.AnalysisUtil;
 import org.apache.asterix.optimizer.rules.am.array.AbstractOperatorFromSubplanRewrite;
 import org.apache.asterix.translator.ConstantHelper;
-import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.mutable.Mutable;
 import org.apache.commons.lang3.mutable.MutableObject;
 import org.apache.hyracks.algebricks.common.exceptions.AlgebricksException;

asterixdb/pom.xml

@@ -91,9 +91,9 @@
     <!-- Versions under dependencymanagement or used in many projects via properties -->
     <algebricks.version>0.3.10-SNAPSHOT</algebricks.version>
     <hyracks.version>0.3.10-SNAPSHOT</hyracks.version>
-    <hadoop.version>3.4.1</hadoop.version>
+    <hadoop.version>3.4.2</hadoop.version>
     <jacoco.version>0.7.6.201602180812</jacoco.version>
-    <log4j.version>2.22.1</log4j.version>
+    <log4j.version>2.25.3</log4j.version>
     <!-- IMPORTANT: please keep the aws-crt version in sync with that defined in the AWS SDK BOM -->
     <!-- you can get this by inspecting the aws-sdk-java-pom for the SDK version. e.g.
      $ curl -s https://repo1.maven.org/maven2/software/amazon/awssdk/aws-sdk-java-pom/2.31.57/aws-sdk-java-pom-2.31.57.pom | grep awscrt.version
@@ -1878,15 +1878,10 @@
       <dependency>
         <groupId>io.grpc</groupId>
         <artifactId>grpc-bom</artifactId>
-        <version>1.78.0</version>
+        <version>1.79.0</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
-      <dependency>
-        <groupId>io.grpc</groupId>
-        <artifactId>grpc-netty-shaded</artifactId>
-        <version>1.78.0</version>
-      </dependency>
       <dependency>
         <groupId>io.opencensus</groupId>
         <artifactId>opencensus-contrib-http-util</artifactId>

hyracks-fullstack/pom.xml

@@ -71,7 +71,7 @@
     <!-- Versions under dependencymanagement or used in many projects via properties -->
     <hadoop.version>3.4.1</hadoop.version>
     <jacoco.version>0.7.6.201602180812</jacoco.version>
-    <log4j.version>2.22.1</log4j.version>
+    <log4j.version>2.25.3</log4j.version>
     <snappy.version>1.1.10.5</snappy.version>
     <jackson.version>2.19.2</jackson.version>
     <jackson-databind.version>${jackson.version}</jackson-databind.version>