use dep version override instead of exclusion

Author: PhongChuong

google-cloud-bigquery/pom.xml

@@ -15,6 +15,7 @@
   </parent>
   <properties>
     <site.installationModule>google-cloud-bigquery</site.installationModule>
+    <netty.version>4.1.118.Final</netty.version>
   </properties>
   <dependencies>
     <dependency>
@@ -116,16 +117,22 @@
     <dependency>
       <groupId>org.apache.arrow</groupId>
       <artifactId>arrow-memory-netty</artifactId>
-      <!--
-      Due to JDK8 requirement, we are forced to use arrow version below v18
-      which has io.netty:netty-common a dep. and its vulnerabilities
-      -->
-      <exclusions>
-        <exclusion>
-          <groupId>io.netty</groupId>
-          <artifactId>netty-common</artifactId>
-        </exclusion>
-      </exclusions>
+      <scope>runtime</scope>
+    </dependency>
+    <!--
+    Define io.netty versions to override org.apache.arrow:arrow-memory-netty
+    transitive dependency versions which contains vulnerabilities.
+    -->
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-common</artifactId>
+      <version>${netty.version}</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-buffer</artifactId>
+      <version>${netty.version}</version>
       <scope>runtime</scope>
     </dependency>