Skip to content

fix(deps): bump org.apache.hadoop:hadoop-common from 3.4.3 to 3.5.0 #6227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix(deps): bump org.apache.hadoop:hadoop-common from 3.4.3 to 3.5.0 #6227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6ca670b
fix(deps): bump org.apache.hadoop:hadoop-common from 3.4.3 to 3.5.0
dependabot[bot] Jul 7, 2026
9e3545b
fix(deps): keep Jersey at 2.25.1 and sync amber licenses for hadoop-c…
Jul 7, 2026
68cb774
Merge origin/main; make Hadoop 3.5.0 consistent engine-wide and exclu…
Jul 9, 2026
21495e2
Merge branch 'main' into dependabot/sbt/org.apache.hadoop-hadoop-comm…
aglinxinyuan Jul 9, 2026
6ef6eee
docs(deps): clarify the hadoop web-stack exclusion comments
Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions amber/LICENSE-binary-java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,6 +368,7 @@ Scala/Java jars:
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- joda-time.joda-time-2.11.0.jar
- net.jodah.failsafe-2.4.4.jar
- org.agrona.agrona-1.22.0.jar
- org.apache.arrow.arrow-format-19.0.0.jar
- org.apache.arrow.arrow-memory-core-19.0.0.jar
Expand All @@ -387,14 +388,14 @@ Scala/Java jars:
- org.apache.curator.curator-client-5.2.0.jar
- org.apache.curator.curator-framework-5.2.0.jar
- org.apache.curator.curator-recipes-5.2.0.jar
- org.apache.hadoop.hadoop-annotations-3.4.3.jar
- org.apache.hadoop.hadoop-auth-3.4.3.jar
- org.apache.hadoop.hadoop-common-3.4.3.jar
- org.apache.hadoop.hadoop-hdfs-client-3.4.3.jar
- org.apache.hadoop.hadoop-mapreduce-client-core-3.4.3.jar
- org.apache.hadoop.hadoop-yarn-api-3.4.3.jar
- org.apache.hadoop.hadoop-yarn-client-3.4.3.jar
- org.apache.hadoop.hadoop-yarn-common-3.4.3.jar
- org.apache.hadoop.hadoop-annotations-3.5.0.jar
- org.apache.hadoop.hadoop-auth-3.5.0.jar
- org.apache.hadoop.hadoop-common-3.5.0.jar
- org.apache.hadoop.hadoop-hdfs-client-3.5.0.jar
- org.apache.hadoop.hadoop-mapreduce-client-core-3.5.0.jar
- org.apache.hadoop.hadoop-yarn-api-3.5.0.jar
- org.apache.hadoop.hadoop-yarn-client-3.5.0.jar
- org.apache.hadoop.hadoop-yarn-common-3.5.0.jar
- org.apache.hadoop.thirdparty.hadoop-shaded-guava-1.5.0.jar
- org.apache.hadoop.thirdparty.hadoop-shaded-protobuf_3_25-1.5.0.jar
- org.apache.httpcomponents.client5.httpclient5-5.4.3.jar
Expand Down Expand Up @@ -627,6 +628,7 @@ licensed with GPL-2.0 with Classpath Exception)

Scala/Java jars:
- jakarta.annotation.jakarta.annotation-api-2.1.1.jar
- jakarta.servlet.jakarta.servlet-api-4.0.4.jar
- jakarta.ws.rs.jakarta.ws.rs-api-3.0.0.jar
- javax.ws.rs.javax.ws.rs-api-2.1.1.jar
- org.jgrapht.jgrapht-core-1.4.0.jar
Expand Down Expand Up @@ -678,7 +680,6 @@ CDDL 1.1
~~~~~~~~

Scala/Java jars:
- com.sun.jersey.contribs.jersey-guice-1.19.4.jar
- javax.websocket.javax.websocket-api-1.0.jar
- javax.websocket.javax.websocket-client-api-1.0.jar
- javax.xml.bind.jaxb-api-2.3.0.jar
Expand Down
237 changes: 135 additions & 102 deletions amber/NOTICE-binary
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1241,55 +1241,6 @@ Copyright 2001-2024 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (https://www.apache.org/).

--------------------------------------------------------------------------------
jakarta.xml.bind.jakarta.xml.bind-api
--------------------------------------------------------------------------------

# Notices for Eclipse Project for JAXB

This content is produced and maintained by the Eclipse Project for JAXB project.

* Project home: https://projects.eclipse.org/projects/ee4j.jaxb

## Trademarks

Eclipse Project for JAXB is a trademark of the Eclipse Foundation.

## Copyright

All content is the property of the respective authors or their employers. For
more information regarding authorship of content, please consult the listed
source code repository logs.

## Declared Project Licenses

This program and the accompanying materials are made available under the terms
of the Eclipse Distribution License v. 1.0 which is available
at http://www.eclipse.org/org/documents/edl-v10.php.

SPDX-License-Identifier: BSD-3-Clause

## Source Code

The project maintains the following source code repositories:

* https://github.com/eclipse-ee4j/jaxb-api

## Third-party Content

This project leverages the following third party content.

None

## Cryptography

Content may contain encryption software. The country in which you are currently
may have restrictions on the import, possession, and use, and/or re-export to
another country, of encryption software. BEFORE using any encryption software,
please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.

--------------------------------------------------------------------------------
org.apache.commons.commons-vfs2
--------------------------------------------------------------------------------
Expand Down Expand Up @@ -1406,6 +1357,88 @@ Copyright 2001-2019 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

--------------------------------------------------------------------------------
jakarta.xml.bind.jakarta.xml.bind-api
--------------------------------------------------------------------------------

[//]: # " Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved. "
[//]: # " "
[//]: # " This program and the accompanying materials are made available under the "
[//]: # " terms of the Eclipse Distribution License v. 1.0, which is available at "
[//]: # " http://www.eclipse.org/org/documents/edl-v10.php. "
[//]: # " "
[//]: # " SPDX-License-Identifier: BSD-3-Clause "

# Notices for Jakarta XML Binding

This content is produced and maintained by the Jakarta XML Binding
project.

* Project home: https://projects.eclipse.org/projects/ee4j.jaxb

## Trademarks

Jakarta XML Binding is a trademark of the Eclipse Foundation.

## Copyright

All content is the property of the respective authors or their employers. For
more information regarding authorship of content, please consult the listed
source code repository logs.

## Declared Project Licenses

This program and the accompanying materials are made available under the terms
of the Eclipse Distribution License v. 1.0 which is available at
http://www.eclipse.org/org/documents/edl-v10.php.

SPDX-License-Identifier: BSD-3-Clause

## Source Code

The project maintains the following source code repositories:

* https://github.com/eclipse-ee4j/jaxb-api
* https://github.com/eclipse-ee4j/jaxb-tck

## Third-party Content

This project leverages the following third party content.

Apache River (3.0.0)

* License: Apache-2.0 AND BSD-3-Clause

ASM 7 (n/a)

* License: BSD-3-Clause
* Project: https://asm.ow2.io/
* Source:
https://repository.ow2.org/nexus/#nexus-search;gav~org.ow2.asm~asm-commons~~~~kw,versionexpand

JTHarness (5.0)

* License: (GPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0)
* Project: https://wiki.openjdk.java.net/display/CodeTools/JT+Harness
* Source: http://hg.openjdk.java.net/code-tools/jtharness/

normalize.css (3.0.2)

* License: MIT

SigTest (n/a)

* License: GPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0

## Cryptography

Content may contain encryption software. The country in which you are currently
may have restrictions on the import, possession, and use, and/or re-export to
another country, of encryption software. BEFORE using any encryption software,
please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.

--------------------------------------------------------------------------------
org.apache.kerby.kerby-config
--------------------------------------------------------------------------------
Expand All @@ -1427,14 +1460,42 @@ This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

--------------------------------------------------------------------------------
com.google.inject.extensions.guice-servlet
jakarta.activation.jakarta.activation-api
--------------------------------------------------------------------------------

Google Guice - Extensions - Servlet
Copyright 2006-2020 Google, Inc.
# Notices for Jakarta Activation

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
This content is produced and maintained by Jakarta Activation project.

* Project home: https://projects.eclipse.org/projects/ee4j.jaf

## Copyright

All content is the property of the respective authors or their employers. For
more information regarding authorship of content, please consult the listed
source code repository logs.

## Declared Project Licenses

This program and the accompanying materials are made available under the terms
of the Eclipse Distribution License v. 1.0,
which is available at http://www.eclipse.org/org/documents/edl-v10.php.

SPDX-License-Identifier: BSD-3-Clause

## Source Code

The project maintains the following source code repositories:

* https://github.com/eclipse-ee4j/jaf

## Third-party Content

This project leverages the following third party content.

JUnit (4.12)

* License: Eclipse Public License

--------------------------------------------------------------------------------
com.google.guava.guava
Expand Down Expand Up @@ -1571,44 +1632,6 @@ Copyright 2009-2024 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

--------------------------------------------------------------------------------
jakarta.activation.jakarta.activation-api
--------------------------------------------------------------------------------

# Notices for Eclipse Project for JAF

This content is produced and maintained by the Eclipse Project for JAF project.

* Project home: https://projects.eclipse.org/projects/ee4j.jaf

## Copyright

All content is the property of the respective authors or their employers. For
more information regarding authorship of content, please consult the listed
source code repository logs.

## Declared Project Licenses

This program and the accompanying materials are made available under the terms
of the Eclipse Distribution License v. 1.0,
which is available at http://www.eclipse.org/org/documents/edl-v10.php.

SPDX-License-Identifier: BSD-3-Clause

## Source Code

The project maintains the following source code repositories:

* https://github.com/eclipse-ee4j/jaf

## Third-party Content

This project leverages the following third party content.

JUnit (4.12)

* License: Eclipse Public License

--------------------------------------------------------------------------------
org.apache.httpcomponents.core5.httpcore5-h2
--------------------------------------------------------------------------------
Expand Down Expand Up @@ -1685,16 +1708,6 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

--------------------------------------------------------------------------------
cglib.cglib
--------------------------------------------------------------------------------

Google Guice - Core Library
Copyright 2006-2020 Google, Inc.

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

--------------------------------------------------------------------------------
org.apache.commons.commons-text
--------------------------------------------------------------------------------
Expand Down Expand Up @@ -1811,6 +1824,16 @@ Other developers who have contributed code are:

* Brian Langel

--------------------------------------------------------------------------------
com.google.inject.guice
--------------------------------------------------------------------------------

Google Guice - Core Library
Copyright 2006-2022 Google, Inc.

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

--------------------------------------------------------------------------------
org.apache.parquet.parquet-avro
--------------------------------------------------------------------------------
Expand Down Expand Up @@ -1937,6 +1960,16 @@ com.esotericsoftware.kryo5
Objenesis
Copyright 2006-2022 Joe Walnes, Henri Tremblay, Leonardo Mesquita

--------------------------------------------------------------------------------
com.google.inject.extensions.guice-servlet
--------------------------------------------------------------------------------

Google Guice - Extensions - Servlet
Copyright 2006-2022 Google, Inc.

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

--------------------------------------------------------------------------------
software.amazon.awssdk.third-party-jackson-core
--------------------------------------------------------------------------------
Expand Down
25 changes: 22 additions & 3 deletions amber/build.sbt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,16 +158,33 @@ val luceneDependencies = Seq(

/////////////////////////////////////////////////////////////////////////////
// Hadoop related
val hadoopVersion = "3.4.3"
val hadoopVersion = "3.5.0"

@aglinxinyuan aglinxinyuan Jul 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — done. I bumped hadoop-common and hadoop-mapreduce-client-core in common/workflow-core/build.sbt to 3.5.0 as well, so every module now resolves a single Hadoop version and there's no cross-module eviction. hdfs-client / yarn-* follow transitively at 3.5.0, and the per-service LICENSE-binary/NOTICE files are re-synced.

val excludeHadoopJersey = ExclusionRule(organization = "com.sun.jersey")
// Hadoop 3.3.2+ ships jersey-json via the com.github.pjfanning fork; its Jersey 1.x
// providers break Jersey 2 auto-discovery at startup, so exclude it as well.
val excludeHadoopJerseyJsonFork = ExclusionRule(organization = "com.github.pjfanning", name = "jersey-json")
// Hadoop 3.5.0 moved its web stack to Jersey 2.x (org.glassfish.jersey.{core,containers,
// inject}) plus the glassfish JAXB runtime, istack-commons, and the Jakarta JSP API. This
// service runs on Dropwizard 1.3.23 (see dropwizardVersion above), whose Jersey 2.25.1
// provides the AbstractValueFactoryProvider that dropwizard-auth binds against; letting
// Hadoop's newer Jersey 2.x win the sbt eviction drops that class and breaks auth wiring.
// Texera uses hadoop only as a filesystem client, so exclude the whole servlet/JAX-RS/JAXB
// web stack instead.
val excludeHadoopJersey2Stack = Seq(
ExclusionRule(organization = "org.glassfish.jersey.core"),
ExclusionRule(organization = "org.glassfish.jersey.containers"),
ExclusionRule(organization = "org.glassfish.jersey.inject"),
ExclusionRule(organization = "org.glassfish.jaxb"),
ExclusionRule(organization = "com.sun.istack"),
ExclusionRule(organization = "jakarta.servlet.jsp")
)
val excludeHadoopSlf4j = ExclusionRule(organization = "org.slf4j")
val excludeHadoopJetty = ExclusionRule(organization = "org.eclipse.jetty")
val excludeHadoopJsp = ExclusionRule(organization = "javax.servlet.jsp")
val hadoopDependencies = Seq(
"org.apache.hadoop" % "hadoop-common" % hadoopVersion excludeAll(excludeHadoopJersey, excludeHadoopJerseyJsonFork, excludeHadoopSlf4j, excludeHadoopJsp, excludeHadoopJetty)
"org.apache.hadoop" % "hadoop-common" % hadoopVersion excludeAll(
(Seq(excludeHadoopJersey, excludeHadoopJerseyJsonFork, excludeHadoopSlf4j, excludeHadoopJsp, excludeHadoopJetty) ++ excludeHadoopJersey2Stack): _*
)
)

/////////////////////////////////////////////////////////////////////////////
Expand Down Expand Up @@ -326,7 +343,9 @@ libraryDependencies += "org.mindrot" % "jbcrypt" % "0.4"
libraryDependencies += "com.github.sisyphsu" % "dateparser" % "1.0.11"

// https://mvnrepository.com/artifact/org.apache.commons/commons-vfs2
libraryDependencies += "org.apache.commons" % "commons-vfs2" % "2.9.0"
// commons-vfs2 pulls hadoop-hdfs-client (HDFS provider), which drags in the Hadoop client
// stack and, via 3.5.0, the Jersey 2.x/JAXB web stack; exclude it here too.
libraryDependencies += "org.apache.commons" % "commons-vfs2" % "2.9.0" excludeAll(excludeHadoopJersey2Stack: _*)

// https://mvnrepository.com/artifact/org.apache.commons/commons-jcs3-core
libraryDependencies += "org.apache.commons" % "commons-jcs3-core" % "3.2.1"
Expand Down
Loading
Loading