Hello team, our vulnerability scanner has been finding packages in starrocks dependencies that are at fault. These dependencies are brought in as part of a shaded jar so it's not something where we can just bump the version of the faulty package to get the fix. Has anyone encountered this issue before and have a fix for it? For example: Our vuln scanner complains about

netty-all	4.1.110.Final

and requests an upgrade to 4.1.136. This is brought in by the jar

kudu-client-1.17.1.jar

. The latest version of kudu client is 1.18.1 which still bring in older versions of

netty-*

package than we need. Is there any path for us to patch it?