(gravitino) branch main updated: [#10529] improvement(all): upgrade Jetty to 9.4.58 and exclude unused Jetty from hive-metastore3-libs (#10532)

[diqiu50]

This is an automated email from the ASF dual-hosted git repository.

diqiu50 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/main by this push:
     new a0ecc9e99b [#10529] improvement(all): upgrade Jetty to 9.4.58 and 
exclude unused Jetty from hive-metastore3-libs (#10532)
a0ecc9e99b is described below

commit a0ecc9e99bad4764eac66c2f3a4b718983da4f37
Author: geyanggang <geyangg...@qq.com>
AuthorDate: Fri Mar 27 15:16:47 2026 +0800

    [#10529] improvement(all): upgrade Jetty to 9.4.58 and exclude unused Jetty 
from hive-metastore3-libs (#10532)
    
    ### What changes were proposed in this pull request?
    
    1. Updated jetty version from 9.4.51.v20230217 to 9.4.58.v20250814 in
    `libs.versions.toml`.
    2. Added exclude("org.eclipse.jetty") to both hadoop2-common and
    hive3-metastore dependencies in `build.gradle.kts`.
    
    ### Why are the changes needed?
    
    1. The Jetty version upgrade brings the latest patches for modules that
    directly use Jetty (iceberg-rest-server, lance-rest-server).
    2. In hive-metastore3-libs, Jetty 9.3.20 is a transitive dependency from
    hadoop-common:3.1.0 (pulled in via hive3-metastore). Due to
    HiveClientClassLoader's classloader isolation, Hadoop classes are loaded
    from the base classloader which already has no Jetty, making these Jetty
    jars dead code. Both hadoop2-common and hive3-metastore need the exclude
    because Gradle resolves hadoop-common 2.10.2 → 3.1.0 (higher version
    wins), creating two dependency paths to Jetty.
    
    Fix: #10529
    
    ### Does this PR introduce _any_ user-facing change?
    
    No.
    
    ### How was this patch tested?
    
    1. Verified compileJava, jar, and test pass for :catalogs:catalog-hive
    and :catalogs:hive-metastore3-libs
    2. Confirmed Jetty no longer appears in hive-metastore3-libs
    runtimeClasspath dependency tree
    
    ---------
    
    Co-authored-by: Yuhui <h...@datastrato.com>
---
 catalogs/hive-metastore3-libs/build.gradle.kts | 6 ++----
 gradle/libs.versions.toml                      | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/catalogs/hive-metastore3-libs/build.gradle.kts 
b/catalogs/hive-metastore3-libs/build.gradle.kts
index fa2a1a56a4..5fbae4cb36 100644
--- a/catalogs/hive-metastore3-libs/build.gradle.kts
+++ b/catalogs/hive-metastore3-libs/build.gradle.kts
@@ -36,8 +36,7 @@ dependencies {
     exclude(group = "log4j")
     exclude(group = "org.apache.avro")
     exclude(group = "org.apache.logging.log4j")
-    exclude(group = "org.eclipse.jetty.aggregate", module = "jetty-all")
-    exclude(group = "org.eclipse.jetty.orbit", module = "javax.servlet")
+    exclude(group = "org.eclipse.jetty")
     exclude(group = "org.slf4j")
   }
   implementation(libs.hive3.metastore) {
@@ -61,8 +60,7 @@ dependencies {
     exclude(group = "org.apache.logging.log4j")
     exclude(group = "org.apache.parquet", module = "parquet-hadoop-bundle")
     exclude(group = "org.datanucleus")
-    exclude(group = "org.eclipse.jetty.aggregate", module = "jetty-all")
-    exclude(group = "org.eclipse.jetty.orbit", module = "javax.servlet")
+    exclude(group = "org.eclipse.jetty")
     exclude(group = "org.openjdk.jol")
     exclude(group = "org.slf4j")
   }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 6e8010a77c..061a98ae1e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -31,7 +31,7 @@ log4j = "2.24.3"
 lance = "0.39.0"
 lance-namespace = "0.0.20"
 delta-kernel = "3.3.0"
-jetty = "9.4.51.v20230217"
+jetty = "9.4.58.v20250814"
 jersey = "2.41"
 mockito = "4.11.0"
 airlift-json = "237"