Skip to content

HIVE-29518: Upgrade jackson to 2.18.6 due to GHSA-72hv-8253-57qq #6385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Manya0407 wants to merge 4 commits into
base: master
Choose a base branch
from
+8 −3
Open

HIVE-29518: Upgrade jackson to 2.18.6 due to GHSA-72hv-8253-57qq #6385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae62595
HIVE-29518:Upgrade jackson-core to 2.18.6 due to GHSA-72hv-8253-57qq
Mar 24, 2026
7ad0e24
Updating java.util.concurrent.locks
Apr 1, 2026
6cbf8ef
Fix TestRuntimeStatsPersistence failure by adding missing setter in O…
Apr 1, 2026
cce8a3a
Adding add-opens for runtime execution
Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions common/src/java/org/apache/hadoop/hive/common/JavaVersionUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ public static String getAddOpensFlagsIfNeeded() {
return " --add-opens=java.base/java.net=ALL-UNNAMED" +
" --add-opens=java.base/java.util=ALL-UNNAMED" +
" --add-opens=java.base/java.util.concurrent=ALL-UNNAMED" +
" --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED" +
" --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED" +
" --add-opens=java.base/java.lang=ALL-UNNAMED" +
" --add-opens=java.base/java.io=ALL-UNNAMED" +
Expand Down
4 changes: 2 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
<test.excludes.additional/>
<!-- Plugin and Plugin Dependency Versions -->
<ant.contrib.version>1.0b3</ant.contrib.version>
<maven.test.jvm.args>-Xmx2048m -DJETTY_AVAILABLE_PROCESSORS=4 -Duser.country=US -Dio.netty.tryReflectionSetAccessible=true -Djava.locale.providers=COMPAT,CLDR --add-opens java.base/java.net=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.nio=ALL-UNNAMED --add-opens java.base/java.util.concurrent=ALL-UNNAMED --add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens java.base/java.util.regex=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.sql/java.sql=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.text=ALL-UNNAMED</maven.test.jvm.args>
<maven.test.jvm.args>-Xmx2048m -DJETTY_AVAILABLE_PROCESSORS=4 -Duser.country=US -Dio.netty.tryReflectionSetAccessible=true -Djava.locale.providers=COMPAT,CLDR --add-opens java.base/java.net=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.nio=ALL-UNNAMED --add-opens java.base/java.util.concurrent=ALL-UNNAMED --add-opens java.base/java.util.concurrent.locks=ALL-UNNAMED --add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens java.base/java.util.regex=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.sql/java.sql=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.text=ALL-UNNAMED</maven.test.jvm.args>
Copy link
Copy Markdown
Member

@ayushtkn ayushtkn Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is done only in maven test jvm args, this would kick in only for test execution not for prod when you actually deploy.

We need to update it at multiple places, where this can kick in.

cc. @tanishq-chugh

Copy link
Copy Markdown
Contributor

@tanishq-chugh tanishq-chugh Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As @ayushtkn rightly pointed out, currently added add-opens change is only for the test scope which is used by the surefire-plugin, for the runtime execution / scope, the add-opens are defined here: JavaVersionUtils

@Manya0407 You'll have to add the same required add opens here as well.

Copy link
Copy Markdown
Author

@Manya0407 Manya0407 Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ayushtkn @tanishq-chugh
I have added add-opens for concurrent.locks in JavaVersionUtils

<maven.checkstyle.plugin.version>3.5.0</maven.checkstyle.plugin.version>
<maven.build-helper.plugin.version>3.4.0</maven.build-helper.plugin.version>
<maven.eclipse.plugin.version>2.10</maven.eclipse.plugin.version>
Expand Down Expand Up @@ -154,7 +154,7 @@
<httpcomponents5.core.version>5.3.4</httpcomponents5.core.version>
<httpcomponents5.client.version>5.5</httpcomponents5.client.version>
<ivy.version>2.5.2</ivy.version>
<jackson.version>2.16.1</jackson.version>
<jackson.version>2.18.6</jackson.version>
<jamon.plugin.version>2.3.4</jamon.plugin.version>
<jamon-runtime.version>2.4.1</jamon-runtime.version>
<javax-servlet.version>3.1.0</javax-servlet.version>
Expand Down
4 changes: 4 additions & 0 deletions ql/src/java/org/apache/hadoop/hive/ql/stats/OperatorStats.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@ public String getOperatorId() {
return operatorId;
}

public void setOperatorId(final String operatorId) {
this.operatorId = operatorId;
}

@Override
public String toString() {
return String.format("OperatorStats %s records: %d", operatorId, outputRecords);
Expand Down
2 changes: 1 addition & 1 deletion standalone-metastore/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@
<guava.version>22.0</guava.version>
<hadoop.version>3.4.2</hadoop.version>
<hikaricp.version>4.0.3</hikaricp.version>
<jackson.version>2.16.1</jackson.version>
<jackson.version>2.18.6</jackson.version>
<jexl.version>3.3</jexl.version>
<javolution.version>5.5.1</javolution.version>
<junit.version>4.13.2</junit.version>
Expand Down
Loading