ProGuard fails due to missing hadoop-shaded-protobuf_3_25 on 4.x releases

[tlopesPT]

ProGuard is working fine with our basic rules up to the 3.1.2 release.
Updating to any release higher than that breaks ProGuard preverification, both for the shaded and unshaded releases, e.g. 4.0.0 or 4.3.0-unshaded.

Preverifying...
error[1004]: proguard.evaluation.exception.IncompleteClassHierarchyException
  --> org/apache/hadoop/ipc/Server$Connection : processOneRpc(Ljava/nio/ByteBuffer;)V at return
200 |     aload v5
202 |     invokevirtual #285
205 |     invokestatic #174
208 |     aload_0 v0
209 |     aload v6
211 |     invokespecial #9
214 |     return
    |     ^^^^^^ Can't find common super class of [org.apache.hadoop.ipc.protobuf.RpcHeaderProtos$RpcRequestHeaderProto] (with 1 known super classes: org.apache.hadoop.ipc.protobuf.RpcHeaderProtos$RpcRequestHeaderProto and 1 unknown classes: org.apache.hadoop.thirdparty.protobuf.GeneratedMessageV3) and [org.apache.hadoop.ipc.RpcServerException] (with 6 known super classes: org.apache.hadoop.ipc.RpcException, java.lang.Exception, org.apache.hadoop.ipc.RpcServerException, java.lang.Object, java.io.IOException, java.lang.Throwable)                                                                          
Variables: [P0:P0:Lorg/apache/hadoop/ipc/Server$Connection;!][P1:P1:Ljava/nio/ByteBuffer;][29:i][35:i][8:E104,M5:Ljava/lang/Object;][22:M16:Lorg/apache/hadoop/ipc/protobuf/RpcHeaderProtos$RpcRequestHeaderProto;][empty:empty]

The issue seems to be related with the deprecated org.apache.hadoop.thirdparty.protobuf.GeneratedMessageV3 class
https://github.com/protocolbuffers/protobuf/blob/6af119088affa46e1d03c4bf228d2e030d53b3aa/java/core/src/main/java/com/google/protobuf/GeneratedMessageV3.java#L30

But I could not pin down the root cause, any ideas?

Thanks

[tlopesPT]

Looking for differences between 3.1.2 and 4.3.1, I can see

<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-common</artifactId>
<version>${hadoop.version}</version>
<exclusions>
...
	<exclusion>
	<groupId>org.apache.hadoop.thirdparty</groupId>
	<artifactId>hadoop-shaded-protobuf_3_25</artifactId>
	</exclusion>
...
</exclusions>

This causes ProGuard preverification step to fail with IncompleteClassHierarchyException because it expects hadoop-shaded-protobuf_3_25 in the classpath.
Using the unshaded sdk and adding hadoop-shaded-protobuf_3_25 fixes ProGuard, but raises the same snyk issues open here.

Are you sure this dependency should have been excluded? I can see imports from shaded-protobuf in e.g. net.snowflake.ingest.internal.org.apache.hadoop.ipc.protobuf.RpcHeaderProtos
Spot any alternative?

Also are you planning to release 4.3.1-unshaded?