From dea33259168871da727453ccdc2c06226d9ac1a8 Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Thu, 11 Dec 2025 15:57:17 +0100
Subject: [PATCH 1/4] HBASE-29770 Exclude commons-logging from HBase

---
 pom.xml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/pom.xml b/pom.xml
index a5f11322bef9..447acdfcfd60 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1514,6 +1514,12 @@
         <groupId>org.apache.httpcomponents</groupId>
         <artifactId>httpclient</artifactId>
         <version>${httpclient.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.apache.httpcomponents</groupId>
@@ -1529,6 +1535,12 @@
         <groupId>commons-validator</groupId>
         <artifactId>commons-validator</artifactId>
         <version>${commons-validator.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>commons-io</groupId>
@@ -4297,6 +4309,10 @@
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-reload4j</artifactId>
               </exclusion>
+              <exclusion>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+              </exclusion>
               <exclusion>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcprov-jdk15on</artifactId>
@@ -4358,6 +4374,10 @@
                 <groupId>javax.ws.rs</groupId>
                 <artifactId>jsr311-api</artifactId>
               </exclusion>
+              <exclusion>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+              </exclusion>
               <exclusion>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcprov-jdk15on</artifactId>

From 7bb1cb3dd0648df9ff8724b05d4f7faea2aa7133 Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Fri, 12 Dec 2025 08:53:06 +0100
Subject: [PATCH 2/4] add missing jcl-over-slf4j dependency to
 hbase-diagnostics

---
 hbase-diagnostics/pom.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hbase-diagnostics/pom.xml b/hbase-diagnostics/pom.xml
index 78e47ac38ab1..6992233b16d5 100644
--- a/hbase-diagnostics/pom.xml
+++ b/hbase-diagnostics/pom.xml
@@ -196,6 +196,11 @@
       <artifactId>jul-to-slf4j</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>jcl-over-slf4j</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.logging.log4j</groupId>
       <artifactId>log4j-1.2-api</artifactId>

From 5c60e2a5687d6c8be80b1fb69ec8395fced0c7bd Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Mon, 5 Jan 2026 17:10:35 +0100
Subject: [PATCH 3/4] set banned-commons-logging rule to transitive

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 447acdfcfd60..bc3bb3d9d826 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2490,7 +2490,7 @@
                     <exclude>commons-logging:commons-logging</exclude>
                   </excludes>
                   <message>We don't use commons-logging any more, so do not depend on it directly.</message>
-                  <searchTransitive>false</searchTransitive>
+                  <searchTransitive>true</searchTransitive>
                 </bannedDependencies>
               </rules>
             </configuration>

From f9e86181099b2473896cbacf7775e6cf7189b9b2 Mon Sep 17 00:00:00 2001
From: Istvan Toth <stoty@apache.org>
Date: Tue, 6 Jan 2026 07:59:17 +0100
Subject: [PATCH 4/4] Add exclusions for Hadoop 3.3.6 and update exclusion rule
 message

---
 pom.xml | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/pom.xml b/pom.xml
index bc3bb3d9d826..5f8c3b5e9c98 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1562,14 +1562,6 @@
         <artifactId>commons-cli</artifactId>
         <version>${commons-cli.version}</version>
       </dependency>
-      <dependency>
-        <!-- commons-logging is only used by hbase-http's HttpRequestLog and hbase-server's
-             HBaseTestingUtil.
-          -->
-        <groupId>commons-logging</groupId>
-        <artifactId>commons-logging</artifactId>
-        <version>1.2</version>
-      </dependency>
       <dependency>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>zookeeper</artifactId>
@@ -2489,7 +2481,7 @@
                   <excludes>
                     <exclude>commons-logging:commons-logging</exclude>
                   </excludes>
-                  <message>We don't use commons-logging any more, so do not depend on it directly.</message>
+                  <message>We don't use commons-logging any more, so do not depend on it directly. We are also using jcl-over-slf4j for libraries so exclude any transitive commons-logging dependencies.</message>
                   <searchTransitive>true</searchTransitive>
                 </bannedDependencies>
               </rules>
@@ -4154,6 +4146,10 @@
                 <groupId>org.openlabtesting.leveldbjni</groupId>
                 <artifactId>leveldbjni-all</artifactId>
               </exclusion>
+              <exclusion>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+              </exclusion>
             </exclusions>
           </dependency>
           <dependency>
@@ -4207,6 +4203,10 @@
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-reload4j</artifactId>
               </exclusion>
+              <exclusion>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+              </exclusion>
             </exclusions>
           </dependency>
           <dependency>
@@ -4459,6 +4459,10 @@
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk15on</artifactId>
               </exclusion>
+              <exclusion>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+              </exclusion>
             </exclusions>
           </dependency>
           <!--