From 9abfda937c945ce65fba3b1db694b7b3e730a34d Mon Sep 17 00:00:00 2001
From: VenkatasivaReddy Avula <venkatasiva.avula@trianz.com>
Date: Thu, 27 Nov 2025 18:01:39 +0530
Subject: [PATCH] GCS CVE issues fix

---
 athena-gcs/assembly.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/athena-gcs/assembly.xml b/athena-gcs/assembly.xml
index fc0b6f75e6..03b022a5fe 100644
--- a/athena-gcs/assembly.xml
+++ b/athena-gcs/assembly.xml
@@ -32,6 +32,10 @@
                     <exclude>META-INF/*.DSA</exclude>
                     <exclude>META-INF/*.RSA</exclude>
                     <exclude>**/Log4j2Plugins.dat</exclude>
+                    <!-- Fix for ALL CVEs related to META-INF path: Exclude all Maven POM metadata files -->
+                    <!-- These POM files cause false-positive CVE alerts in AWS Inspector -->
+                    <exclude>META-INF/maven/**/pom.xml</exclude>
+                    <exclude>META-INF/maven/**/pom.properties</exclude>
                 </excludes>
             </unpackOptions>
         </dependencySet>