[Bug] Bundled NOTICE of paimon-oss-impl lists stale dependency versions after the aliyun-sdk-oss 3.17.4 bump #8966

Search before asking

• I searched in the issues and found nothing similar.

Paimon version
master @ b85955c (2.1-SNAPSHOT)

Compute Engine
Engine-agnostic (packaging / paimon-filesystems/paimon-oss-impl)

Minimal reproduce step

mvn -pl paimon-filesystems/paimon-oss-impl -DskipTests package
unzip -p paimon-filesystems/paimon-oss-impl/target/paimon-oss-impl-*.jar META-INF/NOTICE

The shade log prints Including com.aliyun.oss:aliyun-sdk-oss:jar:3.17.4, but the bundled META-INF/NOTICE still says 3.13.2.

What doesn't meet your expectations?
The bundled NOTICE must list the versions actually shaded into the jar. Six entries are stale: aliyun-sdk-oss (3.13.2), commons-codec (1.9), httpclient (4.4.1), httpcore (4.4.1), jettison (1.1) and jdom2 (2.0.6).

Anything else?
Introduced by #8832 (e039421), which raised fs.oss.sdk.version from 3.13.2 to 3.17.4 without updating the NOTICE — the stale entries match aliyun-sdk-oss:3.13.2's dependency set exactly. paimon-oss shades META-INF/** from this module, so the file ships in the released paimon-oss jar. Same fix shape as #7383 and #6781.

Are you willing to submit a PR?

• I'm willing to submit a PR!