Fix vulnerable Cosmos Spark dependencies

[arnabnandy7]

Description

Fixes #49865.

This pull request updates dependencies bundled in the shaded Cosmos DB Spark 4 connector JARs:

• Excludes the transitive commons-lang:commons-lang:2.6 dependency from the Spark 4.0 and Spark 4.1 dependency graphs.
• Adds org.apache.commons:commons-lang3:3.18.0 to the shared Cosmos DB Spark parent.
• Documents the dependency remediation in both Spark 4 connector changelogs.
• Confirms that the latest upstream dependencies already provide:
  • Netty 4.1.135.Final through azure-core-http-netty:1.16.5.
  • MSAL4J 1.23.1 through azure-identity:1.18.4.

These changes prevent the vulnerable Commons Lang 2.6 classes from being included in the shaded Spark connector JARs while retaining the supported Commons Lang 3 dependency.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which has an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

Testing was limited to XML validation and git diff --check. The existing CI dependency validation and packaging checks will verify the resolved dependency graph and shaded JAR contents.

[github-actions]

Thank you for your contribution @arnabnandy7! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
32 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR targets dependency-vulnerability remediation for the Cosmos DB Spark 4 connectors by preventing commons-lang:commons-lang:2.6 from being pulled into the shaded connector JARs, and documenting the change in the Spark 4 connector changelogs.

Changes:

• Exclude transitive commons-lang:commons-lang from the Spark 4.0 and 4.1 dependency graphs.
• Add org.apache.commons:commons-lang3:3.18.0 to the shared Cosmos Spark parent POM.
• Document the remediation in both Spark 4 connector changelogs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/cosmos/azure-cosmos-spark_4-1_2-13/pom.xml	Excludes transitive commons-lang:commons-lang from Spark 4.1 dependency graph.
sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md	Adds an “Other Changes” entry describing shaded-JAR dependency remediation.
sdk/cosmos/azure-cosmos-spark_4-0_2-13/pom.xml	Excludes transitive commons-lang:commons-lang from Spark 4.0 dependency graph.
sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md	Adds an “Other Changes” entry describing shaded-JAR dependency remediation.
sdk/cosmos/azure-cosmos-spark_3/pom.xml	Adds commons-lang3 dependency at the shared parent level.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

sdk/cosmos/azure-cosmos-spark_3/pom.xml:144

• commons-lang3 is added with <scope>test</scope>, which prevents it from participating in the main (compile/runtime) dependency graph and from being included in the shaded connector JAR (the shade plugin uses non-test scopes). If the intent is to ensure the connector ships with Commons Lang 3 after excluding commons-lang:commons-lang, this should be a regular (compile) dependency (i.e., remove the scope element).

      <version>3.18.0</version> <!-- {x-version-update;org.apache.commons:commons-lang3;external_dependency} -->
      <scope>test</scope>