apache · gianm · Nov 19, 2019 · Nov 16, 2019 · Nov 16, 2019 · Nov 19, 2019
diff --git a/NOTICE b/NOTICE
@@ -26,7 +26,7 @@ Copyright 2014-2019 The Apache Software Foundation
 
 
 
-================= Apache Hadoop 2.8.3 =================
+================= Apache Hadoop 2.8.5 =================
 Apache Hadoop
 Copyright 2009-2017 The Apache Software Foundation
 

diff --git a/distribution/bin/check-licenses.py b/distribution/bin/check-licenses.py
@@ -227,6 +227,7 @@ def build_compatible_license_names():
     compatible_licenses['Public Domain'] = 'Public Domain'
 
     compatible_licenses['BSD-2-Clause License'] = 'BSD-2-Clause License'
+    compatible_licenses['BSD-2-Clause'] = 'BSD-2-Clause License'
 
     compatible_licenses['BSD-3-Clause License'] = 'BSD-3-Clause License'
     compatible_licenses['New BSD license'] = 'BSD-3-Clause License'
@@ -408,4 +409,4 @@ def check_licenses(license_yaml, dependency_reports_root):
         check_licenses(license_yaml, dependency_reports_root)
 
     except KeyboardInterrupt:
-        print('Interrupted, closing.')
+        print('Interrupted, closing.')
diff --git a/docs/configuration/index.md b/docs/configuration/index.md
@@ -1193,7 +1193,7 @@ Additional peon configs include:
 |`druid.peon.mode`|Choices are "local" and "remote". Setting this to local means you intend to run the peon as a standalone process (Not recommended).|remote|
 |`druid.indexer.task.baseDir`|Base temporary working directory.|`System.getProperty("java.io.tmpdir")`|
 |`druid.indexer.task.baseTaskDir`|Base temporary working directory for tasks.|`${druid.indexer.task.baseDir}/persistent/tasks`|
-|`druid.indexer.task.defaultHadoopCoordinates`|Hadoop version to use with HadoopIndexTasks that do not request a particular version.|org.apache.hadoop:hadoop-client:2.8.3|
+|`druid.indexer.task.defaultHadoopCoordinates`|Hadoop version to use with HadoopIndexTasks that do not request a particular version.|org.apache.hadoop:hadoop-client:2.8.5|
 |`druid.indexer.task.defaultRowFlushBoundary`|Highest row count before persisting to disk. Used for indexing generating tasks.|75000|
 |`druid.indexer.task.directoryLockTimeout`|Wait this long for zombie peons to exit before giving up on their replacements.|PT10M|
 |`druid.indexer.task.gracefulShutdownTimeout`|Wait this long on middleManager restart for restorable tasks to gracefully exit.|PT5M|
@@ -1254,7 +1254,7 @@ then the value from the configuration below is used:
 |`druid.worker.numConcurrentMerges`|Maximum number of segment persist or merge operations that can run concurrently across all tasks.|`druid.worker.capacity` / 2, rounded down|
 |`druid.indexer.task.baseDir`|Base temporary working directory.|`System.getProperty("java.io.tmpdir")`|
 |`druid.indexer.task.baseTaskDir`|Base temporary working directory for tasks.|`${druid.indexer.task.baseDir}/persistent/tasks`|
-|`druid.indexer.task.defaultHadoopCoordinates`|Hadoop version to use with HadoopIndexTasks that do not request a particular version.|org.apache.hadoop:hadoop-client:2.8.3|
+|`druid.indexer.task.defaultHadoopCoordinates`|Hadoop version to use with HadoopIndexTasks that do not request a particular version.|org.apache.hadoop:hadoop-client:2.8.5|
 |`druid.indexer.task.gracefulShutdownTimeout`|Wait this long on Indexer restart for restorable tasks to gracefully exit.|PT5M|
 |`druid.indexer.task.hadoopWorkingPath`|Temporary working directory for Hadoop tasks.|`/tmp/druid-indexing`|
 |`druid.indexer.task.restoreTasksOnRestart`|If true, the Indexer will attempt to stop tasks gracefully on shutdown and restore them on restart.|false|

diff --git a/docs/operations/other-hadoop.md b/docs/operations/other-hadoop.md
@@ -89,7 +89,7 @@ classloader.
 2. Batch ingestion uses jars from `hadoop-dependencies/` to submit Map/Reduce jobs (location customizable via the
 `druid.extensions.hadoopDependenciesDir` runtime property; see [Configuration](../configuration/index.html#extensions)).
 
-`hadoop-client:2.8.3` is the default version of the Hadoop client bundled with Druid for both purposes. This works with
+`hadoop-client:2.8.5` is the default version of the Hadoop client bundled with Druid for both purposes. This works with
 many Hadoop distributions (the version does not necessarily need to match), but if you run into issues, you can instead
 have Druid load libraries that exactly match your distribution. To do this, either copy the jars from your Hadoop
 cluster, or use the `pull-deps` tool to download the jars from a Maven repository.

diff --git a/docs/tutorials/tutorial-batch-hadoop.md b/docs/tutorials/tutorial-batch-hadoop.md
@@ -38,18 +38,18 @@ Once the Docker install is complete, please proceed to the next steps in the tut
 
 ## Build the Hadoop docker image
 
-For this tutorial, we've provided a Dockerfile for a Hadoop 2.8.3 cluster, which we'll use to run the batch indexing task.
+For this tutorial, we've provided a Dockerfile for a Hadoop 2.8.5 cluster, which we'll use to run the batch indexing task.
 
 This Dockerfile and related files are located at `quickstart/tutorial/hadoop/docker`.
 
-From the apache-druid-{{DRUIDVERSION}} package root, run the following commands to build a Docker image named "druid-hadoop-demo" with version tag "2.8.3":
+From the apache-druid-{{DRUIDVERSION}} package root, run the following commands to build a Docker image named "druid-hadoop-demo" with version tag "2.8.5":
 
 ```bash
 cd quickstart/tutorial/hadoop/docker
-docker build -t druid-hadoop-demo:2.8.3 .
+docker build -t druid-hadoop-demo:2.8.5 .
 ```
 
-This will start building the Hadoop image. Once the image build is done, you should see the message `Successfully tagged druid-hadoop-demo:2.8.3` printed to the console.
+This will start building the Hadoop image. Once the image build is done, you should see the message `Successfully tagged druid-hadoop-demo:2.8.5` printed to the console.
 
 ## Setup the Hadoop docker cluster
 
@@ -77,7 +77,7 @@ On the host machine, add the following entry to `/etc/hosts`:
 Once the `/tmp/shared` folder has been created and the `etc/hosts` entry has been added, run the following command to start the Hadoop container.
 
 ```bash
-docker run -it  -h druid-hadoop-demo --name druid-hadoop-demo -p 2049:2049 -p 2122:2122 -p 8020:8020 -p 8021:8021 -p 8030:8030 -p 8031:8031 -p 8032:8032 -p 8033:8033 -p 8040:8040 -p 8042:8042 -p 8088:8088 -p 8443:8443 -p 9000:9000 -p 10020:10020 -p 19888:19888 -p 34455:34455 -p 49707:49707 -p 50010:50010 -p 50020:50020 -p 50030:50030 -p 50060:50060 -p 50070:50070 -p 50075:50075 -p 50090:50090 -p 51111:51111 -v /tmp/shared:/shared druid-hadoop-demo:2.8.3 /etc/bootstrap.sh -bash
+docker run -it  -h druid-hadoop-demo --name druid-hadoop-demo -p 2049:2049 -p 2122:2122 -p 8020:8020 -p 8021:8021 -p 8030:8030 -p 8031:8031 -p 8032:8032 -p 8033:8033 -p 8040:8040 -p 8042:8042 -p 8088:8088 -p 8443:8443 -p 9000:9000 -p 10020:10020 -p 19888:19888 -p 34455:34455 -p 49707:49707 -p 50010:50010 -p 50020:50020 -p 50030:50030 -p 50060:50060 -p 50070:50070 -p 50075:50075 -p 50090:50090 -p 51111:51111 -v /tmp/shared:/shared druid-hadoop-demo:2.8.5 /etc/bootstrap.sh -bash
 ```
 
 Once the container is started, your terminal will attach to a bash shell running inside the container:

diff --git a/examples/quickstart/tutorial/hadoop/docker/Dockerfile b/examples/quickstart/tutorial/hadoop/docker/Dockerfile
@@ -14,11 +14,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Creates pseudo distributed hadoop 2.8.3 with java 8
+# Creates pseudo distributed hadoop 2.8.5 with java 8
 #
 # Modified from the SequenceIQ Dockerfiles at https://github.com/sequenceiq/hadoop-docker
 #
-# docker build -t druid-hadoop-demo:2.8.3 .
+# docker build -t druid-hadoop-demo:2.8.5 .
 
 FROM sequenceiq/pam:centos-6.5
 MAINTAINER SequenceIQ
@@ -51,8 +51,8 @@ ENV JAVA_HOME /usr/lib/jvm/zulu-8
 ENV PATH $PATH:$JAVA_HOME/bin
 
 # hadoop
-RUN curl -s https://archive.apache.org/dist/hadoop/core/hadoop-2.8.3/hadoop-2.8.3.tar.gz | tar -xz -C /usr/local/
-RUN cd /usr/local && ln -s ./hadoop-2.8.3 hadoop
+RUN curl -s https://archive.apache.org/dist/hadoop/core/hadoop-2.8.5/hadoop-2.8.5.tar.gz | tar -xz -C /usr/local/
+RUN cd /usr/local && ln -s ./hadoop-2.8.5 hadoop
 
 ENV HADOOP_PREFIX /usr/local/hadoop
 ENV HADOOP_COMMON_HOME /usr/local/hadoop

diff --git a/examples/quickstart/tutorial/wikipedia-index-hadoop.json b/examples/quickstart/tutorial/wikipedia-index-hadoop.json
@@ -75,5 +75,5 @@
       }
     }
   },
-  "hadoopDependencyCoordinates": ["org.apache.hadoop:hadoop-client:2.8.3"]
+  "hadoopDependencyCoordinates": ["org.apache.hadoop:hadoop-client:2.8.5"]
 }
diff --git a/extensions-core/druid-kerberos/pom.xml b/extensions-core/druid-kerberos/pom.xml
@@ -227,6 +227,11 @@
           <groupId>com.nimbusds</groupId>
           <artifactId>nimbus-jose-jwt</artifactId>
         </exclusion>
+        <exclusion>
+          <!-- excluded to remove security vulnerabilities; jackson-mapper-asl is renamed to jackson-databind -->
+          <groupId>org.codehaus.jackson</groupId>
+          <artifactId>jackson-mapper-asl</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>

diff --git a/extensions-core/hdfs-storage/pom.xml b/extensions-core/hdfs-storage/pom.xml
@@ -249,6 +249,11 @@
               <groupId>com.sun.jersey</groupId>
               <artifactId>jersey-server</artifactId>
             </exclusion>
+            <exclusion>
+              <!-- excluded to remove security vulnerabilities; jackson-mapper-asl is renamed to jackson-databind -->
+              <groupId>org.codehaus.jackson</groupId>
+              <artifactId>jackson-mapper-asl</artifactId>
+            </exclusion>
           </exclusions>
         </dependency>
         <dependency>

diff --git a/extensions-core/postgresql-metadata-storage/pom.xml b/extensions-core/postgresql-metadata-storage/pom.xml
@@ -50,7 +50,7 @@
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
-            <version>9.4.1208.jre7</version>
+            <version>42.2.8</version>
         </dependency>
         <dependency>
             <groupId>org.jdbi</groupId>

diff --git a/indexing-service/src/main/java/org/apache/druid/indexing/common/config/TaskConfig.java b/indexing-service/src/main/java/org/apache/druid/indexing/common/config/TaskConfig.java
@@ -34,7 +34,7 @@
 public class TaskConfig
 {
   public static final List<String> DEFAULT_DEFAULT_HADOOP_COORDINATES = ImmutableList.of(
-      "org.apache.hadoop:hadoop-client:2.8.3"
+      "org.apache.hadoop:hadoop-client:2.8.5"
   );
 
   private static final Period DEFAULT_DIRECTORY_LOCK_TIMEOUT = new Period("PT10M");

diff --git a/licenses.yaml b/licenses.yaml
@@ -179,7 +179,7 @@ name: ClassMate
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 1.0.0
+version: 1.1.0
 libraries:
   - com.fasterxml: classmate
 notices:
@@ -200,7 +200,6 @@ version: 2.6.7
 libraries:
   - com.fasterxml.jackson.core: jackson-annotations
   - com.fasterxml.jackson.core: jackson-core
-  - com.fasterxml.jackson.core: jackson-databind
   - com.fasterxml.jackson.dataformat: jackson-dataformat-cbor
   - com.fasterxml.jackson.dataformat: jackson-dataformat-smile
   - com.fasterxml.jackson.datatype: jackson-datatype-guava
@@ -233,11 +232,42 @@ notice: |
 
 ---
 
+name: Jackson
+license_category: binary
+module: java-core
+license_name: Apache License version 2.0
+version: 2.6.7.3
+libraries:
+  - com.fasterxml.jackson.core: jackson-databind
+notice: |
+  # Jackson JSON processor
+
+  Jackson is a high-performance, Free/Open Source JSON processing library.
+  It was originally written by Tatu Saloranta (tatu.saloranta@iki.fi), and has
+  been in development since 2007.
+  It is currently developed by a community of developers, as well as supported
+  commercially by FasterXML.com.
+
+  ## Licensing
+
+  Jackson core and extension components may licensed under different licenses.
+  To find the details that apply to this artifact see the accompanying LICENSE file.
+  For more information, including possible other licensing options, contact
+  FasterXML.com (http://fasterxml.com).
+
+  ## Credits
+
+  A list of contributors may be found from CREDITS file, which is included
+  in some artifacts (usually source distributions); but is always available
+  from the source code management (SCM) system project uses.
+
+---
+
 name: Caffeine
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.5.5
+version: 2.8.0
 libraries:
   - com.github.ben-manes.caffeine: caffeine
 
@@ -375,7 +405,7 @@ name: Apache Commons BeanUtils
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 1.9.3
+version: 1.9.4
 libraries:
   - commons-beanutils: commons-beanutils
 notices:
@@ -389,7 +419,7 @@ name: Apache Commons Codec
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 1.12
+version: 1.13
 libraries:
   - commons-codec: commons-codec
 notices:
@@ -758,7 +788,7 @@ name: Netty
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 4.1.30.Final
+version: 4.1.42.Final
 libraries:
   - io.netty: netty-buffer
   - io.netty: netty-codec
@@ -1317,7 +1347,7 @@ name: Apache Log4j
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.5
+version: 2.8.2
 libraries:
   - org.apache.logging.log4j: log4j-1.2-api
   - org.apache.logging.log4j: log4j-api
@@ -1479,7 +1509,7 @@ name: Plexus Common Utilities
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 3.0.15
+version: 3.0.24
 libraries:
   - org.codehaus.plexus: plexus-utils
 notices:
@@ -1501,7 +1531,7 @@ name: Jetty
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 9.4.10.v20180503
+version: 9.4.12.v20180830
 libraries:
   - org.eclipse.jetty: jetty-client
   - org.eclipse.jetty: jetty-continuation
@@ -1650,7 +1680,7 @@ name: Hibernate Validator Engine
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 5.1.3.Final
+version: 5.2.5.Final
 libraries:
   - org.hibernate: hibernate-validator
 
@@ -1789,7 +1819,7 @@ name: JBoss Logging 3
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 3.1.3.GA
+version: 3.2.1.Final
 libraries:
   - org.jboss.logging: jboss-logging
 
@@ -1880,7 +1910,7 @@ name: Apache Hadoop
 license_category: binary
 module: hadoop-client
 license_name: Apache License version 2.0
-version: 2.8.3
+version: 2.8.5
 libraries:
   - org.apache.hadoop: hadoop-annotations
   - org.apache.hadoop: hadoop-auth
@@ -2355,7 +2385,7 @@ name: Nimbus JOSE+JWT
 license_category: binary
 module: hadoop-client
 license_name: Apache License version 2.0
-version: 3.9
+version: 4.41.1
 libraries:
   - com.nimbusds: nimbus-jose-jwt
 
@@ -2503,7 +2533,7 @@ name: Apache Commons Compress
 license_category: binary
 module: hadoop-client
 license_name: Apache License version 2.0
-version: 1.4.1
+version: 1.19
 libraries:
   - org.apache.commons: commons-compress
 notices:
@@ -2917,7 +2947,7 @@ name: Apache Avro
 license_category: binary
 module: extensions/druid-avro-extensions
 license_name: Apache License version 2.0
-version: 1.9.0
+version: 1.9.1
 libraries:
   - org.apache.avro: avro
   - org.apache.avro: avro-mapred
@@ -3431,10 +3461,10 @@ libraries:
 name: PostgreSQL JDBC Driver
 license_category: binary
 module: extensions/postgresql-metadata-storage
-license_name: BSD-3-Clause License
-version: 9.4.1208.jre7
+license_name: BSD-2-Clause License
+version: 42.2.8
 copyright: PostgreSQL Global Development Group
-license_file_path: licenses/bin/postgresql.BSD3
+license_file_path: licenses/bin/postgresql.BSD2
 libraries:
   - org.postgresql: postgresql
 
@@ -3457,7 +3487,7 @@ name: ICU4J
 license_category: binary
 module: java-core
 license_name: ICU License
-version: 54.1.1
+version: 55.1
 copyright: International Business Machines Corporation and others
 license_file_path: licenses/bin/icu4j.ICU
 libraries:
@@ -3747,15 +3777,13 @@ libraries:
 
 ---
 
-name: \"Java Concurrency In Practice\" Book Annotations
+name: JCIP Annotations Under Apache License
 license_category: binary
-module: hadoop-client
-license_name: Creative Commons Attribution 2.5
-version: 1.0
-copyright: Brian Goetz and Tim Peierls
-license_file_path: licenses/bin/creative-commons-2.5.LICENSE
+module: extensions/druid-hdfs-storage
+license_name: Apache License version 2.0
+version: 1.0-1
 libraries:
-  - net.jcip: jcip-annotations
+  - com.github.stephenc.jcip: jcip-annotations
 
 ---
-Original file line number
+Diff line change
@@ Expand Up / @@ -75,5 +75,5 @@ @@
           }
         }
       },
-      "hadoopDependencyCoordinates": ["org.apache.hadoop:hadoop-client:2.8.3"]
+      "hadoopDependencyCoordinates": ["org.apache.hadoop:hadoop-client:2.8.5"]
     }