[release-2.35.0][BEAM-13499] Add warning about log4j to hcatalog javadoc #16311

Author: tvalentyn

sdks/java/extensions/sql/hcatalog/src/main/java/org/apache/beam/sdk/extensions/sql/meta/provider/hcatalog/package-info.java

@@ -16,7 +16,16 @@
  * limitations under the License.
  */
 
-/** Table schema for HCatalog. */
+/**
+ * Table schema for HCatalog.
+ *
+ * <p><b>WARNING:</b>This package requires users to declare their own dependency on
+ * org.apache.hive:hive-exec and org.apache.hive.hcatalog. At the time of this Beam release every
+ * released version of those packages had a transitive dependency on a version of log4j vulnerable
+ * to CVE-2021-44228. We strongly encourage users to pin a non-vulnerable version of log4j when
+ * using this package. See <a
+ * href="https://issues.apache.org/jira/browse/BEAM-13499">BEAM-13499</a>.
+ */
 @Experimental
 package org.apache.beam.sdk.extensions.sql.meta.provider.hcatalog;
 

sdks/java/io/hcatalog/src/main/java/org/apache/beam/sdk/io/hcatalog/HCatalogIO.java

@@ -70,6 +70,13 @@
 /**
  * IO to read and write data using HCatalog.
  *
+ * <p><b>WARNING:</b>This package requires users to declare their own dependency on
+ * org.apache.hive:hive-exec and org.apache.hive.hcatalog. At the time of this Beam release every
+ * released version of those packages had a transitive dependency on a version of log4j vulnerable
+ * to CVE-2021-44228. We strongly encourage users to pin a non-vulnerable version of log4j when
+ * using this package. See <a
+ * href="https://issues.apache.org/jira/browse/BEAM-13499">BEAM-13499</a>.
+ *
  * <h3>Reading using HCatalog</h3>
  *
  * <p>HCatalog source supports reading of HCatRecord from a HCatalog managed source, for eg. Hive.

sdks/java/io/hcatalog/src/main/java/org/apache/beam/sdk/io/hcatalog/package-info.java

@@ -16,7 +16,16 @@
  * limitations under the License.
  */
 
-/** Transforms for reading and writing using HCatalog. */
+/**
+ * Transforms for reading and writing using HCatalog.
+ *
+ * <p><b>WARNING:</b>This package requires users to declare their own dependency on
+ * org.apache.hive:hive-exec and org.apache.hive.hcatalog. At the time of this Beam release every
+ * released version of those packages had a transitive dependency on a version of log4j vulnerable
+ * to CVE-2021-44228. We strongly encourage users to pin a non-vulnerable version of log4j when
+ * using this package. See <a
+ * href="https://issues.apache.org/jira/browse/BEAM-13499">BEAM-13499</a>.
+ */
 @Experimental(Kind.SOURCE_SINK)
 package org.apache.beam.sdk.io.hcatalog;