From f8ff0837856644479a07b744cd4669fdd79d3b27 Mon Sep 17 00:00:00 2001
From: leventov <leventov@ya.ru>
Date: Mon, 22 May 2017 20:02:35 -0500
Subject: [PATCH 1/5] Update dependencies

---
 extensions-contrib/cassandra-storage/pom.xml  |  4 +
 extensions-contrib/orc-extensions/pom.xml     |  6 ++
 extensions-contrib/rabbitmq/pom.xml           |  4 +
 .../sqlserver-metadata-storage/pom.xml        |  1 -
 extensions-contrib/thrift-extensions/pom.xml  |  6 ++
 extensions-core/avro-extensions/pom.xml       | 24 +++++
 .../kafka-extraction-namespace/pom.xml        | 12 +++
 .../kafka-indexing-service/pom.xml            |  2 +-
 extensions-core/lookups-cached-global/pom.xml | 12 +++
 integration-tests/pom.xml                     |  8 ++
 pom.xml                                       | 90 +++++++++++++++----
 server/pom.xml                                | 16 +++-
 12 files changed, 165 insertions(+), 20 deletions(-)

diff --git a/extensions-contrib/cassandra-storage/pom.xml b/extensions-contrib/cassandra-storage/pom.xml
index 6c8d99f7af86..e5bda9d742ba 100644
--- a/extensions-contrib/cassandra-storage/pom.xml
+++ b/extensions-contrib/cassandra-storage/pom.xml
@@ -113,6 +113,10 @@
                     <groupId>org.slf4j</groupId>
                     <artifactId>slf4j-log4j12</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>com.github.stephenc.high-scale-lib</groupId>
+                    <artifactId>high-scale-lib</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
diff --git a/extensions-contrib/orc-extensions/pom.xml b/extensions-contrib/orc-extensions/pom.xml
index d29cfd2b5009..b0bb2c9b749f 100644
--- a/extensions-contrib/orc-extensions/pom.xml
+++ b/extensions-contrib/orc-extensions/pom.xml
@@ -140,6 +140,12 @@
             <artifactId>hive-orc</artifactId>
             <version>${hive.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.hadoop</groupId>
+                    <artifactId>hadoop-common</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.google.inject</groupId>
diff --git a/extensions-contrib/rabbitmq/pom.xml b/extensions-contrib/rabbitmq/pom.xml
index cf4a34785e63..51f15b974f14 100644
--- a/extensions-contrib/rabbitmq/pom.xml
+++ b/extensions-contrib/rabbitmq/pom.xml
@@ -54,6 +54,10 @@
                     <groupId>org.slf4j</groupId>
                     <artifactId>slf4j-api</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>com.rabbitmq</groupId>
+                    <artifactId>amqp-client</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
diff --git a/extensions-contrib/sqlserver-metadata-storage/pom.xml b/extensions-contrib/sqlserver-metadata-storage/pom.xml
index bc93ced358c8..d8d5939374ae 100644
--- a/extensions-contrib/sqlserver-metadata-storage/pom.xml
+++ b/extensions-contrib/sqlserver-metadata-storage/pom.xml
@@ -60,7 +60,6 @@
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
-            <version>4.10</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/extensions-contrib/thrift-extensions/pom.xml b/extensions-contrib/thrift-extensions/pom.xml
index 36d11e426f3a..369a78b7f2b6 100644
--- a/extensions-contrib/thrift-extensions/pom.xml
+++ b/extensions-contrib/thrift-extensions/pom.xml
@@ -56,6 +56,12 @@
       <groupId>com.twitter.elephantbird</groupId>
       <artifactId>elephant-bird-core</artifactId>
       <version>${elephantbird.version}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.thrift</groupId>
+          <artifactId>libthrift</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.twitter.elephantbird</groupId>
diff --git a/extensions-core/avro-extensions/pom.xml b/extensions-core/avro-extensions/pom.xml
index a02d043223d6..1b46f490473b 100644
--- a/extensions-core/avro-extensions/pom.xml
+++ b/extensions-core/avro-extensions/pom.xml
@@ -108,12 +108,36 @@
       <version>0.15.0</version>
       <classifier>h2</classifier>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>commons-net</groupId>
+          <artifactId>commons-net</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.pig</groupId>
       <artifactId>piggybank</artifactId>
       <version>0.15.0</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>log4j</groupId>
+          <artifactId>log4j</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.pig</groupId>
+          <artifactId>pig</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>io.druid</groupId>
diff --git a/extensions-core/kafka-extraction-namespace/pom.xml b/extensions-core/kafka-extraction-namespace/pom.xml
index 50b7fbc912df..5e14b1018852 100644
--- a/extensions-core/kafka-extraction-namespace/pom.xml
+++ b/extensions-core/kafka-extraction-namespace/pom.xml
@@ -91,6 +91,12 @@
       <groupId>org.apache.curator</groupId>
       <artifactId>curator-test</artifactId>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>org.javassist</groupId>
+          <artifactId>javassist</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>mx4j</groupId>
@@ -102,6 +108,12 @@
       <groupId>org.easymock</groupId>
       <artifactId>easymock</artifactId>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>org.objenesis</groupId>
+          <artifactId>objenesis</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
diff --git a/extensions-core/kafka-indexing-service/pom.xml b/extensions-core/kafka-indexing-service/pom.xml
index 9ddcd3fc872d..b3a97925e842 100644
--- a/extensions-core/kafka-indexing-service/pom.xml
+++ b/extensions-core/kafka-indexing-service/pom.xml
@@ -49,7 +49,7 @@
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty</artifactId>
-      <version>3.10.4.Final</version>
+      <version>3.10.6.Final</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
diff --git a/extensions-core/lookups-cached-global/pom.xml b/extensions-core/lookups-cached-global/pom.xml
index 4c0424dfb7c6..da9a3e563a2f 100644
--- a/extensions-core/lookups-cached-global/pom.xml
+++ b/extensions-core/lookups-cached-global/pom.xml
@@ -70,6 +70,12 @@
       <groupId>org.apache.curator</groupId>
       <artifactId>curator-test</artifactId>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>org.javassist</groupId>
+          <artifactId>javassist</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>mx4j</groupId>
@@ -81,6 +87,12 @@
       <groupId>org.easymock</groupId>
       <artifactId>easymock</artifactId>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>org.objenesis</groupId>
+          <artifactId>objenesis</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
diff --git a/integration-tests/pom.xml b/integration-tests/pom.xml
index d64b5d35271d..74d76ca5bb38 100644
--- a/integration-tests/pom.xml
+++ b/integration-tests/pom.xml
@@ -112,6 +112,14 @@
                     <groupId>org.slf4j</groupId>
                     <artifactId>slf4j-log4j12</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>com.101tec</groupId>
+                    <artifactId>zkclient</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.kafka</groupId>
+                    <artifactId>kafka-clients</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
diff --git a/pom.xml b/pom.xml
index 68e864fff10c..f34bd623bb2d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -58,17 +58,17 @@
     </scm>
 
     <properties>
-        <apache.curator.version>2.11.0</apache.curator.version>
+        <apache.curator.version>2.12.0</apache.curator.version>
         <avatica.version>1.9.0</avatica.version>
         <calcite.version>1.11.0</calcite.version>
         <guava.version>16.0.1</guava.version>
         <guice.version>4.1.0</guice.version>
-        <jetty.version>9.3.16.v20170120</jetty.version>
-        <jersey.version>1.19</jersey.version>
+        <jetty.version>9.3.19.v20170502</jetty.version>
+        <jersey.version>1.19.3</jersey.version>
         <!-- Watch out for Hadoop compatibility when updating to >= 2.5; see https://github.com/druid-io/druid/pull/1669 -->
         <jackson.version>2.4.6</jackson.version>
         <log4j.version>2.5</log4j.version>
-        <netty.version>4.1.6.Final</netty.version>
+        <netty.version>4.1.11.Final</netty.version>
         <slf4j.version>1.7.12</slf4j.version>
         <!-- If compiling with different hadoop version also modify default hadoop coordinates in TaskConfig.java -->
         <hadoop.compile.version>2.3.0</hadoop.compile.version>
@@ -139,17 +139,23 @@
             <dependency>
                 <groupId>com.metamx</groupId>
                 <artifactId>emitter</artifactId>
-                <version>0.4.1</version>
+                <version>0.4.5</version>
             </dependency>
             <dependency>
                 <groupId>com.metamx</groupId>
                 <artifactId>http-client</artifactId>
-                <version>1.0.6</version>
+                <version>1.1.0</version>
             </dependency>
             <dependency>
                 <groupId>com.metamx</groupId>
                 <artifactId>server-metrics</artifactId>
                 <version>0.2.8</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>com.metamx</groupId>
+                        <artifactId>java-util</artifactId>
+                    </exclusion>
+                </exclusions>
             </dependency>
             <dependency>
                 <groupId>commons-codec</groupId>
@@ -164,7 +170,7 @@
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.4</version>
+                <version>2.5</version>
             </dependency>
             <dependency>
                 <groupId>commons-logging</groupId>
@@ -179,7 +185,7 @@
             <dependency>
                 <groupId>com.amazonaws</groupId>
                 <artifactId>aws-java-sdk</artifactId>
-                <version>1.10.21</version>
+                <version>1.11.132</version>
                 <exclusions>
                     <exclusion>
                         <groupId>javax.mail</groupId>
@@ -197,6 +203,14 @@
                         <groupId>commons-codec</groupId>
                         <artifactId>commons-codec</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>com.amazonaws</groupId>
+                        <artifactId>aws-java-sdk-swf-libraries</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>com.amazonaws</groupId>
+                        <artifactId>aws-java-sdk-models</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>
@@ -230,7 +244,7 @@
             <dependency>
                 <groupId>org.apache.zookeeper</groupId>
                 <artifactId>zookeeper</artifactId>
-                <version>3.4.9</version>
+                <version>3.4.10</version>
                 <exclusions>
                     <exclusion>
                         <groupId>org.slf4j</groupId>
@@ -240,6 +254,10 @@
                         <groupId>log4j</groupId>
                         <artifactId>log4j</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>io.netty</groupId>
+                        <artifactId>netty</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>
@@ -311,7 +329,7 @@
             <dependency>
                 <groupId>com.ibm.icu</groupId>
                 <artifactId>icu4j</artifactId>
-                <version>4.8.1</version>
+                <version>54.1.1</version>
             </dependency>
             <dependency>
                 <groupId>org.mozilla</groupId>
@@ -413,6 +431,11 @@
                 <artifactId>jersey-server</artifactId>
                 <version>${jersey.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.sun.jersey</groupId>
+                <artifactId>jersey-json</artifactId>
+                <version>${jersey.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.eclipse.jetty</groupId>
                 <artifactId>jetty-server</artifactId>
@@ -438,6 +461,11 @@
                 <artifactId>jetty-util</artifactId>
                 <version>${jetty.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.eclipse.jetty</groupId>
+                <artifactId>jetty-security</artifactId>
+                <version>${jetty.version}</version>
+            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-all</artifactId>
@@ -446,7 +474,7 @@
             <dependency>
                 <groupId>joda-time</groupId>
                 <artifactId>joda-time</artifactId>
-                <version>2.8.2</version>
+                <version>2.9.9</version>
             </dependency>
             <dependency>
                 <groupId>com.google.code.findbugs</groupId>
@@ -495,12 +523,12 @@
             <dependency>
                 <groupId>com.lmax</groupId>
                 <artifactId>disruptor</artifactId>
-                <version>3.3.0</version>
+                <version>3.3.6</version>
             </dependency>
             <dependency>
                 <groupId>net.spy</groupId>
                 <artifactId>spymemcached</artifactId>
-                <version>2.11.7</version>
+                <version>2.12.3</version>
             </dependency>
             <dependency>
                 <groupId>org.antlr</groupId>
@@ -583,12 +611,12 @@
             <dependency>
                 <groupId>org.apache.httpcomponents</groupId>
                 <artifactId>httpclient</artifactId>
-                <version>4.5.1</version>
+                <version>4.5.3</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.httpcomponents</groupId>
                 <artifactId>httpcore</artifactId>
-                <version>4.4.3</version>
+                <version>4.4.6</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.hadoop</groupId>
@@ -619,7 +647,7 @@
             <dependency>
                 <groupId>it.unimi.dsi</groupId>
                 <artifactId>fastutil</artifactId>
-                <version>7.0.13</version>
+                <version>7.2.0</version>
             </dependency>
             <dependency>
                 <groupId>net.sf.opencsv</groupId>
@@ -651,6 +679,36 @@
                 <artifactId>asm-commons</artifactId>
                 <version>5.2</version>
             </dependency>
+            <dependency>
+                <groupId>org.codehaus.jackson</groupId>
+                <artifactId>jackson-core-asl</artifactId>
+                <version>1.9.13</version>
+            </dependency>
+            <dependency>
+                <groupId>org.codehaus.jackson</groupId>
+                <artifactId>jackson-mapper-asl</artifactId>
+                <version>1.9.13</version>
+            </dependency>
+            <dependency>
+                <groupId>javax.servlet</groupId>
+                <artifactId>javax.servlet-api</artifactId>
+                <version>3.1.0</version>
+            </dependency>
+            <dependency>
+                <groupId>javax.activation</groupId>
+                <artifactId>activation</artifactId>
+                <version>1.1.1</version>
+            </dependency>
+            <dependency>
+                <groupId>commons-pool</groupId>
+                <artifactId>commons-pool</artifactId>
+                <version>1.6</version>
+            </dependency>
+            <dependency>
+                <groupId>org.codehaus.plexus</groupId>
+                <artifactId>plexus-utils</artifactId>
+                <version>3.0.15</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.calcite</groupId>
                 <artifactId>calcite-core</artifactId>
diff --git a/server/pom.xml b/server/pom.xml
index a6898e8bcf6b..7cf251da92e0 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -218,14 +218,26 @@
         <dependency>
             <groupId>com.sun.jersey.jersey-test-framework</groupId>
             <artifactId>jersey-test-framework-core</artifactId>
-            <version>1.19</version>
+            <version>${jersey.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>javax.servlet</groupId>
+                    <artifactId>javax.servlet-api</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.sun.jersey.jersey-test-framework</groupId>
             <artifactId>jersey-test-framework-grizzly2</artifactId>
-            <version>1.19</version>
+            <version>${jersey.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>javax.servlet</groupId>
+                    <artifactId>javax.servlet-api</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>pl.pragmatists</groupId>

From dab641a9cb982642585bbdaa9940d58f439f8a3b Mon Sep 17 00:00:00 2001
From: leventov <leventov@ya.ru>
Date: Tue, 23 May 2017 00:55:42 -0500
Subject: [PATCH 2/5] Downgrade curator

---
 pom.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f34bd623bb2d..b2f9bea91233 100644
--- a/pom.xml
+++ b/pom.xml
@@ -58,7 +58,8 @@
     </scm>
 
     <properties>
-        <apache.curator.version>2.12.0</apache.curator.version>
+        <!-- Curator cannot be updated to 2.12.0 yet, see https://github.com/druid-io/druid/pull/4103 -->
+        <apache.curator.version>2.11.0</apache.curator.version>
         <avatica.version>1.9.0</avatica.version>
         <calcite.version>1.11.0</calcite.version>
         <guava.version>16.0.1</guava.version>

From 8ebc20d3d029725ed101ca18d6f76c6c39a808e2 Mon Sep 17 00:00:00 2001
From: leventov <leventov@ya.ru>
Date: Thu, 25 May 2017 19:39:05 -0500
Subject: [PATCH 3/5] Rollback aws-java-sdk dependency to 1.10.77

---
 pom.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index b2f9bea91233..a2d7e9452324 100644
--- a/pom.xml
+++ b/pom.xml
@@ -186,7 +186,9 @@
             <dependency>
                 <groupId>com.amazonaws</groupId>
                 <artifactId>aws-java-sdk</artifactId>
-                <version>1.11.132</version>
+                <!-- Cannot update to AWS SDK 1.11+ because of Jackson incompatibility.
+                     Need to update Druid to use Jackson 2.6+ -->
+                <version>1.10.77</version>
                 <exclusions>
                     <exclusion>
                         <groupId>javax.mail</groupId>

From e5fac2b505d5661a02d73f0f91872a7f9de01c33 Mon Sep 17 00:00:00 2001
From: leventov <leventov@ya.ru>
Date: Thu, 1 Jun 2017 19:04:56 -0500
Subject: [PATCH 4/5] Revert exclusions in integration-tests

---
 integration-tests/pom.xml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/integration-tests/pom.xml b/integration-tests/pom.xml
index 7b9dff28be0e..981811065f9f 100644
--- a/integration-tests/pom.xml
+++ b/integration-tests/pom.xml
@@ -115,14 +115,6 @@
                     <artifactId>slf4j-log4j12</artifactId>
                     <groupId>org.slf4j</groupId>
                 </exclusion>
-                <exclusion>
-                    <groupId>com.101tec</groupId>
-                    <artifactId>zkclient</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>org.apache.kafka</groupId>
-                    <artifactId>kafka-clients</artifactId>
-                </exclusion>
             </exclusions>
         </dependency>
     </dependencies>

From 10bd7ed219094c0c22465b9c09011616365b46a1 Mon Sep 17 00:00:00 2001
From: leventov <leventov@ya.ru>
Date: Thu, 8 Jun 2017 14:56:45 -0500
Subject: [PATCH 5/5] Depend only on aws-java-sdk-ec2 instead of umbrella
 aws-java-sdk (fixes #4382)

---
 aws-common/pom.xml |  2 +-
 pom.xml            | 10 +---------
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/aws-common/pom.xml b/aws-common/pom.xml
index d61e0f955dd4..1b063211a036 100644
--- a/aws-common/pom.xml
+++ b/aws-common/pom.xml
@@ -37,7 +37,7 @@
         </dependency>
         <dependency>
             <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk</artifactId>
+            <artifactId>aws-java-sdk-ec2</artifactId>
         </dependency>
 
         <!-- Tests -->
diff --git a/pom.xml b/pom.xml
index a3b5d5ac53fd..b4076adae3b7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -186,7 +186,7 @@
             </dependency>
             <dependency>
                 <groupId>com.amazonaws</groupId>
-                <artifactId>aws-java-sdk</artifactId>
+                <artifactId>aws-java-sdk-ec2</artifactId>
                 <!-- Cannot update to AWS SDK 1.11+ because of Jackson incompatibility.
                      Need to update Druid to use Jackson 2.6+ -->
                 <version>1.10.77</version>
@@ -207,14 +207,6 @@
                         <groupId>commons-codec</groupId>
                         <artifactId>commons-codec</artifactId>
                     </exclusion>
-                    <exclusion>
-                        <groupId>com.amazonaws</groupId>
-                        <artifactId>aws-java-sdk-swf-libraries</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>com.amazonaws</groupId>
-                        <artifactId>aws-java-sdk-models</artifactId>
-                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>