What would you like to be improved?

Gravitino currently lacks automated dependency scanning to identify known vulnerabilities in third-party libraries. Adding a scanner would help maintain a clean dependency footprint and provide an auditable triage process for transitive dependency risks.

How should we improve?

1. Integrate the OWASP Dependency-Check Gradle plugin to scan runtimeClasspath across all subprojects.
2. Add a suppression file (suppressions.xml) with documented triage decisions for transitive dependencies from the Hadoop/Hive/Spark/Flink ecosystem.
3. Add a manually-triggered GitHub Actions workflow for on-demand scanning.
4. Upgrade Gradle wrapper from 8.2 to 8.14.4 (required for OWASP plugin 12.x compatibility).