HIVE-29253:bump netty version to 4.1.127.Final due to CVE-2025-58057 …

[ramitg254]

…CVE-2025-58056

What changes were proposed in this pull request?

netty version upgrade to 4.1.127.Final to fix cves

Why are the changes needed?

current netty version is suffering from cves

Does this PR introduce any user-facing change?

No

How was this patch tested?

local build

[ramitg254]

@deniskuzZ can you please review it

[InvisibleProgrammer]

Netty 4.2.6.Final is the latest release. Could it worth to upgrade to that release?

[ramitg254]

Netty 4.2.6.Final is the latest release. Could it worth to upgrade to that release?

Hadoop trunk is also at netty 4.1.127 according to https://issues.apache.org/jira/browse/HADOOP-19689?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel.
So trying keep it in sync with that

[deniskuzZ]

+1

[Aggarwal-Raghav]

I'm ok with the changes in current PR. I just want to hightlight that the following jars with older version are also getting shipped. It is irrespective of this PR.

netty-handler-4.1.105.Final.jar
netty-transport-native-epoll-4.1.105.Final.jar

[deniskuzZ]

I'm ok with the changes in current PR. I just want to hightlight that the following jars with older version are also getting shipped. It is irrespective of this PR.

@Aggarwal-Raghav, thanks for validating this! In this case PR is not complete. @ramitg254 could you please make sure we don't bring multiple versions of netty dependencies

[INFO] +- org.apache.hadoop:hadoop-hdfs:jar:3.4.1:compile
[INFO] |  +- io.netty:netty-all:jar:4.1.100.Final:compile

mvn dependency:tree | grep 'netty-all' | grep '4.1' | grep -v 'optional' | grep -v ':test' | sed -E 's/.io.netty:netty-all:jar:([0-9.]+.Final):./\1/' | sort -u

4.1.100.Final
4.1.116.Final

incomplete

[ramitg254]

dependency-tree.txt
@deniskuzZ I have enforced use of single version 4.1.127.Final of netty now,
I hadn't done it earlier because the other version like 4.1.100 and 4.1.105 were coming from Hadoop and zookeeper and that I thought could be handled when Hadoop and zookeeper upgrade will take place and I saw earlier netty upgrade for version 4.1.116.Final was done in similar fashion instead of other versions from these dependencies.
So I think we have two options here:

1. Enforcing a single version like current
2. Or let the other versions upgrade happen when Hadoop and zookeeper upgrade will take place

Also I think option 1 is more suitable as we already have netty-all in dependency management of project pom so by adding other deps which are part of netty-all but pulled transitively by some other deps like Hadoop and zookeeper and causing version variation can be avoided

[InvisibleProgrammer]

Why it was necessary to pull netty into standalone-metastore and storage-api?

[ramitg254]

Why it was necessary to pull netty into standalone-metastore and storage-api?

In these modules due to presence of :

<parent>
    <groupId>org.apache</groupId>
    <artifactId>apache</artifactId>
    <version>23</version>
 </parent>

in place of :

<parent>
    <groupId>org.apache.hive</groupId>
    <artifactId>hive</artifactId>
    <version>4.2.0-SNAPSHOT</version>
    <relativePath>../pom.xml</relativePath>
  </parent>

It’s not inheriting the dependency management rules defined in the project’s POM, so they need to be added explicitly

[InvisibleProgrammer]

LGTM. Please do not forget to squash the commits.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[deniskuzZ]

+1