Fix CVE-2015-5237, CVE-2024-7254, CVE-2022-3171, CVE-2021-22569, CVE-2021-22570

[terrymanu]

Exclude protobuf-javanano to fix:

https://nvd.nist.gov/vuln/detail/CVE-2015-5237
https://nvd.nist.gov/vuln/detail/CVE-2024-7254
https://nvd.nist.gov/vuln/detail/CVE-2022-3171
https://nvd.nist.gov/vuln/detail/CVE-2021-22569
https://nvd.nist.gov/vuln/detail/CVE-2021-22570

[Copilot]

Pull request overview

This PR centralizes an exclusion of protobuf-javanano from Netty protobuf codec to address several protobuf-related CVEs, and documents the change in the release notes.

Changes:

• Add a managed io.netty:netty-codec-protobuf dependency with an exclusion for com.google.protobuf.nano:protobuf-javanano in the root dependencyManagement POM.
• Update RELEASE-NOTES.md to record the CVEs addressed by this change and link to the PR.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pom.xml	Adds a dependencyManagement entry for io.netty:netty-codec-protobuf that excludes protobuf-javanano, ensuring all module usages inherit the exclusion and mitigating the listed CVEs.
RELEASE-NOTES.md	Documents the newly fixed CVEs for release 5.5.3, referencing this PR, though the new line currently contains a duplicated “CVE” and a duplicated CVE ID.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This new entry lists CVE-2024-7254 again even though it is already covered by the previous line, which may confuse readers about which PR actually resolves the issue; consider either omitting CVE-2024-7254 here or clarifying how this PR’s fix relates to the earlier one.

Suggested change

	1. Fix CVE-2015-5237, CVE-2024-7254, CVE-2022-3171, CVE-2021-22569, CVE-2021-22570 [#37888](https://github.com/apache/shardingsphere/pull/37888)
	1. Fix CVE-2015-5237, CVE-2022-3171, CVE-2021-22569, CVE-2021-22570 [#37888](https://github.com/apache/shardingsphere/pull/37888)