Skip to content

Commit 5e4e9f3

Browse files
dervoetirazvan
dervoeti
and
razvan
committed
chore: bump hbase, phoenix and hbase-operator-tools (#997)
Co-authored-by: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
1 parent 362ef66 commit 5e4e9f3

9 files changed

+733
-6
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ All notable changes to this project will be documented in this file.
2222
- java: Add JDK/JRE 23 ([#992]).
2323
- trino: Add 469 ([#993]).
2424
- trino-cli: Add version 469 ([#993]).
25+
- hbase: Support for 2.6.1 ([#997]).
2526
- trino-storage-connector: Add version 469 ([#996]).
2627
- trino: Add 470 ([#999]).
2728
- trino-cli: Add version 470 ([#999]).
@@ -69,6 +70,7 @@ All notable changes to this project will be documented in this file.
6970
[#993]: https://github.com/stackabletech/docker-images/pull/993
7071
[#995]: https://github.com/stackabletech/docker-images/pull/995
7172
[#996]: https://github.com/stackabletech/docker-images/pull/996
73+
[#997]: https://github.com/stackabletech/docker-images/pull/997
7274
[#999]: https://github.com/stackabletech/docker-images/pull/999
7375
[#1000]: https://github.com/stackabletech/docker-images/pull/1000
7476

‎hbase/stackable/patches/2.6.1/01-HBASE-28242.patch

Lines changed: 384 additions & 0 deletions
Large diffs are not rendered by default.

‎hbase/stackable/patches/2.6.1/02-patch-updates.patch

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
diff --git a/pom.xml b/pom.xml
2+
index 01123cb..3734fb1 100644
3+
--- a/pom.xml
4+
+++ b/pom.xml
5+
@@ -567,7 +567,7 @@
6+
modules and cause trouble if we only rely on transitive dependencies.
7+
-->
8+
<netty3.version>3.10.6.Final</netty3.version>
9+
- <netty4.version>4.1.112.Final</netty4.version>
10+
+ <netty4.version>4.1.117.Final</netty4.version>
11+
<!-- end HBASE-15925 default hadoop compatibility values -->
12+
<audience-annotations.version>0.13.0</audience-annotations.version>
13+
<!--
14+
@@ -576,28 +576,28 @@
15+
-->
16+
<javadoc.audience-annotations.version>0.13.0</javadoc.audience-annotations.version>
17+
<avro.version>1.11.4</avro.version>
18+
- <caffeine.version>2.8.1</caffeine.version>
19+
+ <caffeine.version>2.8.8</caffeine.version>
20+
<commons-codec.version>1.15</commons-codec.version>
21+
<commons-io.version>2.11.0</commons-io.version>
22+
<commons-lang3.version>3.9</commons-lang3.version>
23+
<commons-math.version>3.6.1</commons-math.version>
24+
<commons-cli.version>1.5.0</commons-cli.version>
25+
<disruptor.version>3.4.4</disruptor.version>
26+
- <httpclient.version>4.5.13</httpclient.version>
27+
- <httpcore.version>4.4.13</httpcore.version>
28+
+ <httpclient.version>4.5.14</httpclient.version>
29+
+ <httpcore.version>4.4.16</httpcore.version>
30+
<metrics-core.version>3.2.6</metrics-core.version>
31+
<!--
32+
Note that the version of jackson-[annotations,core,databind] must be kept in sync with the
33+
version of jackson-jaxrs-json-provider shipped in hbase-thirdparty.
34+
-->
35+
- <jackson.version>2.17.2</jackson.version>
36+
- <jackson.databind.version>2.17.2</jackson.databind.version>
37+
+ <jackson.version>2.17.3</jackson.version>
38+
+ <jackson.databind.version>2.17.3</jackson.databind.version>
39+
<jaxb-api.version>2.3.1</jaxb-api.version>
40+
<servlet.api.version>3.1.0</servlet.api.version>
41+
<wx.rs.api.version>2.1.1</wx.rs.api.version>
42+
- <glassfish.jsp.version>2.3.2</glassfish.jsp.version>
43+
- <glassfish.el.version>3.0.1-b08</glassfish.el.version>
44+
- <jruby.version>9.3.13.0</jruby.version>
45+
+ <glassfish.jsp.version>2.3.4</glassfish.jsp.version>
46+
+ <glassfish.el.version>3.0.1-b12</glassfish.el.version>
47+
+ <jruby.version>9.3.15.0</jruby.version>
48+
<junit.version>4.13.2</junit.version>
49+
<hamcrest.version>1.3</hamcrest.version>
50+
<opentelemetry.version>1.15.0</opentelemetry.version>
51+
@@ -615,19 +615,19 @@
52+
<internal.protobuf.version>4.28.2</internal.protobuf.version>
53+
<protobuf.plugin.version>0.6.1</protobuf.plugin.version>
54+
<thrift.path>thrift</thrift.path>
55+
- <thrift.version>0.14.1</thrift.version>
56+
+ <thrift.version>0.14.2</thrift.version>
57+
<zookeeper.version>3.8.4</zookeeper.version>
58+
<jline.version>2.11</jline.version>
59+
- <slf4j.version>1.7.33</slf4j.version>
60+
+ <slf4j.version>1.7.36</slf4j.version>
61+
<clover.version>4.0.3</clover.version>
62+
<jamon-runtime.version>2.4.1</jamon-runtime.version>
63+
<jettison.version>1.5.4</jettison.version>
64+
<!--Make sure these joni/jcodings are compatible with the versions used by jruby-->
65+
- <joni.version>2.2.1</joni.version>
66+
- <jcodings.version>1.0.58</jcodings.version>
67+
- <spy.version>2.12.2</spy.version>
68+
- <bouncycastle.version>1.78</bouncycastle.version>
69+
- <skyscreamer.version>1.5.1</skyscreamer.version>
70+
+ <joni.version>2.2.3</joni.version>
71+
+ <jcodings.version>1.0.61</jcodings.version>
72+
+ <spy.version>2.12.3</spy.version>
73+
+ <bouncycastle.version>1.78.1</bouncycastle.version>
74+
+ <skyscreamer.version>1.5.3</skyscreamer.version>
75+
<kerby.version>1.0.1</kerby.version>
76+
<commons-crypto.version>1.1.0</commons-crypto.version>
77+
<curator.version>4.2.0</curator.version>
78+
@@ -644,27 +644,27 @@
79+
<lifecycle.mapping.version>1.0.0</lifecycle.mapping.version>
80+
<maven.antrun.version>1.8</maven.antrun.version>
81+
<maven.bundle.version>3.3.0</maven.bundle.version>
82+
- <maven.checkstyle.version>3.1.0</maven.checkstyle.version>
83+
+ <maven.checkstyle.version>3.1.2</maven.checkstyle.version>
84+
<maven.eclipse.version>2.10</maven.eclipse.version>
85+
<maven.gpg.version>3.0.1</maven.gpg.version>
86+
- <maven.javadoc.version>3.4.0</maven.javadoc.version>
87+
- <maven.warbucks.version>1.1.0</maven.warbucks.version>
88+
+ <maven.javadoc.version>3.4.1</maven.javadoc.version>
89+
+ <maven.warbucks.version>1.1.2</maven.warbucks.version>
90+
<maven.project.info.report.version>3.1.2</maven.project.info.report.version>
91+
<os.maven.version>1.5.0.Final</os.maven.version>
92+
<findbugs-annotations.version>1.3.9-1</findbugs-annotations.version>
93+
<spotbugs.version>4.7.3</spotbugs.version>
94+
- <spotbugs.maven.version>4.7.2.1</spotbugs.maven.version>
95+
- <surefire.version>3.1.0</surefire.version>
96+
+ <spotbugs.maven.version>4.7.3.6</spotbugs.maven.version>
97+
+ <surefire.version>3.1.2</surefire.version>
98+
<wagon.ssh.version>2.12</wagon.ssh.version>
99+
<xml.maven.version>1.0.1</xml.maven.version>
100+
<spotless.version>2.27.2</spotless.version>
101+
- <maven-site.version>3.12.0</maven-site.version>
102+
+ <maven-site.version>3.12.1</maven-site.version>
103+
<!-- compression -->
104+
<aircompressor.version>0.27</aircompressor.version>
105+
<brotli4j.version>1.11.0</brotli4j.version>
106+
<lz4.version>1.8.0</lz4.version>
107+
- <snappy.version>1.1.10.4</snappy.version>
108+
- <zstd-jni.version>1.5.5-2</zstd-jni.version>
109+
+ <snappy.version>1.1.10.7</snappy.version>
110+
+ <zstd-jni.version>1.5.6-9</zstd-jni.version>
111+
<!--
112+
Note that the version of protobuf shipped in hbase-thirdparty must match the version used
113+
in hbase-protocol-shaded and hbase-examples. The version of jackson-[annotations,core,

‎hbase/stackable/patches/2.6.1/03-include-dataformat-xml.patch

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
Include jackson-dataformat-xml.
2+
3+
From: Lars Francke <git@lars-francke.de>
4+
5+
This is needed for XmlLayout to work so our structured logging works.
6+
It is an optional dependency of log4j2 so we need to make sure to include
7+
it.
8+
---
9+
hbase-assembly/pom.xml | 5 +++++
10+
pom.xml | 12 ++++++++++++
11+
2 files changed, 17 insertions(+)
12+
13+
diff --git a/hbase-assembly/pom.xml b/hbase-assembly/pom.xml
14+
index 1564851b85..0786288a84 100644
15+
--- a/hbase-assembly/pom.xml
16+
+++ b/hbase-assembly/pom.xml
17+
@@ -222,6 +222,11 @@
18+
<groupId>org.apache.logging.log4j</groupId>
19+
<artifactId>log4j-core</artifactId>
20+
</dependency>
21+
+ <dependency>
22+
+ <!-- This is an optional dependency of log4j which is needed to use XmlLayout -->
23+
+ <groupId>com.fasterxml.jackson.dataformat</groupId>
24+
+ <artifactId>jackson-dataformat-xml</artifactId>
25+
+ </dependency>
26+
<dependency>
27+
<groupId>org.apache.logging.log4j</groupId>
28+
<artifactId>log4j-slf4j-impl</artifactId>
29+
diff --git a/pom.xml b/pom.xml
30+
index b420025c6c..819e021d86 100644
31+
--- a/pom.xml
32+
+++ b/pom.xml
33+
@@ -1149,6 +1149,11 @@
34+
<artifactId>log4j-core</artifactId>
35+
<version>${log4j2.version}</version>
36+
</dependency>
37+
+ <dependency>
38+
+ <groupId>org.apache.logging.log4j</groupId>
39+
+ <artifactId>log4j-core</artifactId>
40+
+ <version>${log4j2.version}</version>
41+
+ </dependency>
42+
<dependency>
43+
<groupId>org.apache.logging.log4j</groupId>
44+
<artifactId>log4j-slf4j-impl</artifactId>
45+
@@ -1159,6 +1164,13 @@
46+
<artifactId>log4j-1.2-api</artifactId>
47+
<version>${log4j2.version}</version>
48+
</dependency>
49+
+ <dependency>
50+
+ <!-- This is an optional dependency of log4j which is needed to use XmlLayout -->
51+
+ <groupId>com.fasterxml.jackson.dataformat</groupId>
52+
+ <artifactId>jackson-dataformat-xml</artifactId>
53+
+ <version>${jackson.databind.version}</version>
54+
+ </dependency>
55+
+
56+
<!-- Avro dependencies we mostly get transitively, manual version coallescing -->
57+
<dependency>
58+
<groupId>org.apache.avro</groupId>

‎hbase/stackable/patches/2.6.1/04-patch-cyclonedx-plugin.patch

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
diff --git a/pom.xml b/pom.xml
2+
index 918cdaa..2a83794 100644
3+
--- a/pom.xml
4+
+++ b/pom.xml
5+
@@ -3218,7 +3218,11 @@
6+
<plugin>
7+
<groupId>org.cyclonedx</groupId>
8+
<artifactId>cyclonedx-maven-plugin</artifactId>
9+
- <version>2.7.10</version>
10+
+ <version>2.9.1</version>
11+
+ <configuration>
12+
+ <projectType>application</projectType>
13+
+ <schemaVersion>1.5</schemaVersion>
14+
+ </configuration>
15+
<executions>
16+
<execution>
17+
<goals>

‎hbase/stackable/patches/hbase-operator-tools/1.3.0-fd5a5fb/01-cyclonedx-plugin.patch

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
diff --git a/pom.xml b/pom.xml
2+
index caa032a..0025687 100644
3+
--- a/pom.xml
4+
+++ b/pom.xml
5+
@@ -549,6 +549,23 @@
6+
</formats>
7+
</configuration>
8+
</plugin>
9+
+ <plugin>
10+
+ <groupId>org.cyclonedx</groupId>
11+
+ <artifactId>cyclonedx-maven-plugin</artifactId>
12+
+ <version>2.9.1</version>
13+
+ <configuration>
14+
+ <projectType>application</projectType>
15+
+ <schemaVersion>1.5</schemaVersion>
16+
+ </configuration>
17+
+ <executions>
18+
+ <execution>
19+
+ <goals>
20+
+ <goal>makeBom</goal>
21+
+ </goals>
22+
+ <phase>package</phase>
23+
+ </execution>
24+
+ </executions>
25+
+ </plugin>
26+
</plugins>
27+
</build>
28+
<profiles>

‎hbase/stackable/patches/phoenix/5.2.1/01-cyclonedx-plugin.patch

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
diff --git a/pom.xml b/pom.xml
2+
index bce2398..4abcb5a 100644
3+
--- a/pom.xml
4+
+++ b/pom.xml
5+
@@ -680,6 +680,23 @@
6+
<extensions>true</extensions>
7+
<inherited>true</inherited>
8+
</plugin>
9+
+ <plugin>
10+
+ <groupId>org.cyclonedx</groupId>
11+
+ <artifactId>cyclonedx-maven-plugin</artifactId>
12+
+ <version>2.9.1</version>
13+
+ <configuration>
14+
+ <projectType>application</projectType>
15+
+ <schemaVersion>1.5</schemaVersion>
16+
+ </configuration>
17+
+ <executions>
18+
+ <execution>
19+
+ <goals>
20+
+ <goal>makeBom</goal>
21+
+ </goals>
22+
+ <phase>package</phase>
23+
+ </execution>
24+
+ </executions>
25+
+ </plugin>
26+
</plugins>
27+
</build>
28+

‎hbase/stackable/patches/phoenix/5.2.1/02-CVE-2023-34455-update-snappy-version.patch

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
Fix CVE-2023-34455
2+
3+
See https://github.com/stackabletech/vulnerabilities/issues/558
4+
5+
diff --git a/phoenix-core-client/pom.xml b/phoenix-core-client/pom.xml
6+
index f711b0f6f..3cfbffef9 100644
7+
--- a/phoenix-core-client/pom.xml
8+
+++ b/phoenix-core-client/pom.xml
9+
@@ -230,6 +230,12 @@
10+
<groupId>org.apache.hadoop</groupId>
11+
<artifactId>hadoop-auth</artifactId>
12+
</dependency>
13+
+ <!-- Fix CVE-2023-34455 -->
14+
+ <dependency>
15+
+ <groupId>org.xerial.snappy</groupId>
16+
+ <artifactId>snappy-java</artifactId>
17+
+ <version>1.1.10.4</version>
18+
+ </dependency>
19+
20+
<!-- HBase dependencies -->
21+
<dependency>
22+
diff --git a/phoenix-core-server/pom.xml b/phoenix-core-server/pom.xml
23+
index d5032ece2..e47fb0837 100644
24+
--- a/phoenix-core-server/pom.xml
25+
+++ b/phoenix-core-server/pom.xml
26+
@@ -59,6 +59,12 @@
27+
<groupId>org.apache.hadoop</groupId>
28+
<artifactId>hadoop-mapreduce-client-core</artifactId>
29+
</dependency>
30+
+ <!-- Fix CVE-2023-34455 -->
31+
+ <dependency>
32+
+ <groupId>org.xerial.snappy</groupId>
33+
+ <artifactId>snappy-java</artifactId>
34+
+ <version>1.1.10.4</version>
35+
+ </dependency>
36+
37+
<!-- HBase dependencies -->
38+
<dependency>
39+
@@ -192,4 +198,4 @@
40+
</plugin>
41+
</plugins>
42+
</build>
43+
-</project>
44+
\ No newline at end of file
45+
+</project>
46+
diff --git a/phoenix-pherf/pom.xml b/phoenix-pherf/pom.xml
47+
index c03fff9a1..cdcce2f98 100644
48+
--- a/phoenix-pherf/pom.xml
49+
+++ b/phoenix-pherf/pom.xml
50+
@@ -159,6 +159,12 @@
51+
<groupId>org.apache.hbase</groupId>
52+
<artifactId>hbase-server</artifactId>
53+
</dependency>
54+
+ <!-- Fix CVE-2023-34455 -->
55+
+ <dependency>
56+
+ <groupId>org.xerial.snappy</groupId>
57+
+ <artifactId>snappy-java</artifactId>
58+
+ <version>1.1.10.4</version>
59+
+ </dependency>
60+
61+
<!-- Test Dependencies -->
62+
<dependency>
63+
diff --git a/phoenix-tracing-webapp/pom.xml b/phoenix-tracing-webapp/pom.xml
64+
index d2d1549ef..c8054159e 100755
65+
--- a/phoenix-tracing-webapp/pom.xml
66+
+++ b/phoenix-tracing-webapp/pom.xml
67+
@@ -89,6 +89,12 @@
68+
<groupId>org.apache.hbase</groupId>
69+
<artifactId>hbase-common</artifactId>
70+
</dependency>
71+
+ <!-- Fix CVE-2023-34455 -->
72+
+ <dependency>
73+
+ <groupId>org.xerial.snappy</groupId>
74+
+ <artifactId>snappy-java</artifactId>
75+
+ <version>1.1.10.4</version>
76+
+ </dependency>
77+
</dependencies>
78+
79+
<build>
80+
diff --git a/pom.xml b/pom.xml
81+
index 4abcb5a28..21dcf71ad 100644
82+
--- a/pom.xml
83+
+++ b/pom.xml
84+
@@ -850,6 +850,13 @@
85+
</exclusion>
86+
</exclusions>
87+
</dependency>
88+
+ <!-- Fix CVE-2023-34455 -->
89+
+ <dependency>
90+
+ <groupId>org.xerial.snappy</groupId>
91+
+ <artifactId>snappy-java</artifactId>
92+
+ <version>1.1.10.4</version>
93+
+ </dependency>
94+
+
95+
<dependency>
96+
<groupId>org.apache.hadoop</groupId>
97+
<artifactId>hadoop-common</artifactId>

‎hbase/versions.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,21 +12,21 @@
1212
"hbase_profile": "2.4",
1313
"hadoop": "3.3.6",
1414
"jmx_exporter": "1.0.1-stackable", # update the stackable/jmx/config<version> folder too
15-
"opa_authorizer": "", # only for HBase 2.6.0
15+
"opa_authorizer": "", # only for HBase 2.6.1
1616
"delete_caches": "true",
1717
},
1818
{
19-
"product": "2.6.0",
20-
"hbase_thirdparty": "4.1.7",
21-
"hbase_operator_tools": "1.3.0-7c738fc",
19+
"product": "2.6.1",
20+
"hbase_thirdparty": "4.1.9",
21+
"hbase_operator_tools": "1.3.0-fd5a5fb",
2222
"java-base": "11",
2323
"java-devel": "11",
2424
"async_profiler": "2.9",
25-
"phoenix": "5.3.0-4afe457",
25+
"phoenix": "5.2.1",
2626
"hbase_profile": "2.6",
2727
"hadoop": "3.3.6",
2828
"jmx_exporter": "", # 2.6 exports jmx and prometheus metrics by default
29-
"opa_authorizer": "0.1.0", # only for HBase 2.6.0
29+
"opa_authorizer": "0.1.0", # only for HBase 2.6.1
3030
"delete_caches": "true",
3131
},
3232
]

0 commit comments

Comments
 (0)