feat(hive): Add 4.2.1, drop 4.0.1

CHANGELOG.md

@@ -13,6 +13,7 @@ All notable changes to this project will be documented in this file.
 - hive: Restore the `get_table` and `get_table_objects_by_name` Thrift methods that HIVE-26537 removed in Hive 4.0.1, for `4.2.0` ([#1636]).
 - hadoop, spark: Add SBOMs for the pre-built JavaScript that is vendored into the source tree for the HDFS and Spark web UIs ([#1620]).
 - stats-exporter: Add `0.31.0` ([#1664]).
+- hive: Add `4.2.1` ([#1637]).
 
 ### Changed
 
@@ -58,6 +59,7 @@ All notable changes to this project will be documented in this file.
 
 ### Removed
 
+- hive: Remove `4.0.1` ([#1637]).
 - omid: remove 1.1.2 ([#1593]).
 - ci: Remove SLSA build provenance generation for published image indexes ([#1596]).
 
@@ -72,6 +74,7 @@ All notable changes to this project will be documented in this file.
 [#1630]: https://github.com/stackabletech/docker-images/pull/1630
 [#1635]: https://github.com/stackabletech/docker-images/pull/1635
 [#1636]: https://github.com/stackabletech/docker-images/pull/1636
+[#1637]: https://github.com/stackabletech/docker-images/pull/1637
 [#1638]: https://github.com/stackabletech/docker-images/pull/1638
 [#1641]: https://github.com/stackabletech/docker-images/pull/1641
 [#1664]: https://github.com/stackabletech/docker-images/pull/1664

hive/boil-config.toml

@@ -26,25 +26,24 @@ java-devel = "8"
 jmx-exporter-version = "1.3.0"
 
 
-[versions."4.0.1".local-images]
-# Hive 4.0 must be built with Java 8 (according to GitHub README) but seems to run on Java 11
-java-base = "11"
-java-devel = "8"
-"hadoop/hadoop" = "3.3.6"
+[versions."4.2.0".local-images]
+# Hive 4.2 requires Java 21 (according to GitHub README)
+java-base = "21"
+java-devel = "21"
+"hadoop/hadoop" = "3.4.3"
 # hive-metastore-opa-authorizer from: https://github.com/boschglobal/hive-metastore-opa-authorizer
-"hive/hive-metastore-opa-authorizer" = "v1.0.0-hive-4.0.1-hadoop-3.3.6"
+"hive/hive-metastore-opa-authorizer" = "v1.0.0-hive-4.2.0-hadoop-3.4.3"
 
-[versions."4.0.1".build-arguments]
+[versions."4.2.0".build-arguments]
 jmx-exporter-version = "1.3.0"
 
-
-[versions."4.2.0".local-images]
+[versions."4.2.1".local-images]
 # Hive 4.2 requires Java 21 (according to GitHub README)
 java-base = "21"
 java-devel = "21"
 "hadoop/hadoop" = "3.4.3"
 # hive-metastore-opa-authorizer from: https://github.com/boschglobal/hive-metastore-opa-authorizer
-"hive/hive-metastore-opa-authorizer" = "v1.0.0-hive-4.2.0-hadoop-3.4.3"
+"hive/hive-metastore-opa-authorizer" = "v1.0.0-hive-4.2.1-hadoop-3.4.3"
 
-[versions."4.2.0".build-arguments]
+[versions."4.2.1".build-arguments]
 jmx-exporter-version = "1.3.0"

hive/hive-metastore-opa-authorizer/boil-config.toml

@@ -16,15 +16,6 @@ authorizer-version = "v1.0.0"
 hive-version = "4.0.0"
 delete-caches = "true"
 
-[versions."v1.0.0-hive-4.0.1-hadoop-3.3.6".local-images]
-"java-devel" = "11"
-"hadoop/hadoop" = "3.3.6"
-
-[versions."v1.0.0-hive-4.0.1-hadoop-3.3.6".build-arguments]
-authorizer-version = "v1.0.0"
-hive-version = "4.0.1"
-delete-caches = "true"
-
 [versions."v1.0.0-hive-4.1.0-hadoop-3.4.3".local-images]
 "java-devel" = "17"
 "hadoop/hadoop" = "3.4.3"
@@ -42,3 +33,12 @@ delete-caches = "true"
 authorizer-version = "v1.0.0"
 hive-version = "4.2.0"
 delete-caches = "true"
+
+[versions."v1.0.0-hive-4.2.1-hadoop-3.4.3".local-images]
+"java-devel" = "21"
+"hadoop/hadoop" = "3.4.3"
+
+[versions."v1.0.0-hive-4.2.1-hadoop-3.4.3".build-arguments]
+authorizer-version = "v1.0.0"
+hive-version = "4.2.1"
+delete-caches = "true"

hive/stackable/patches/4.0.1/0001-Include-Postgres-driver.patch → hive/stackable/patches/4.2.1/0001-Include-Postgres-driver.patch

@@ -1,6 +1,6 @@
-From 44d83fa02779ac3135f76ce711f11c108a432ea3 Mon Sep 17 00:00:00 2001
-From: Sebastian Bernauer <sebastian.bernauer@stackable.de>
-Date: Tue, 3 Sep 2024 11:13:24 +0200
+From 9bfbe159795b690bdf5eb19e83bd227ae9345082 Mon Sep 17 00:00:00 2001
+From: Malte Sander <malte.sander.it@gmail.com>
+Date: Tue, 25 Nov 2025 11:29:03 +0100
 Subject: Include Postgres driver
 
 ---
@@ -9,10 +9,10 @@ Subject: Include Postgres driver
  2 files changed, 2 deletions(-)
 
 diff --git a/standalone-metastore/metastore-server/pom.xml b/standalone-metastore/metastore-server/pom.xml
-index 3d14d6b2e3..fdc813c5b9 100644
+index fd68c6cb65..b07aa0228d 100644
 --- a/standalone-metastore/metastore-server/pom.xml
 +++ b/standalone-metastore/metastore-server/pom.xml
-@@ -334,7 +334,6 @@
+@@ -338,7 +338,6 @@
      <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
@@ -21,10 +21,10 @@ index 3d14d6b2e3..fdc813c5b9 100644
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
 diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
-index 744b88c6db..c0bb928611 100644
+index 69de496b40..4f75c22dec 100644
 --- a/standalone-metastore/pom.xml
 +++ b/standalone-metastore/pom.xml
-@@ -399,7 +399,6 @@
+@@ -435,7 +435,6 @@
          <groupId>org.postgresql</groupId>
          <artifactId>postgresql</artifactId>
          <version>${postgres.version}</version>

hive/stackable/patches/4.0.1/0002-Include-logging-dependencies.patch → hive/stackable/patches/4.2.1/0002-Include-logging-dependencies.patch

@@ -1,18 +1,17 @@
-From ed96173868c88142fded0291f901d84d6c63ed51 Mon Sep 17 00:00:00 2001
-From: Lars Francke <lars.francke@stackable.tech>
-Date: Tue, 13 Aug 2024 13:38:12 +0200
+From 09fa507880275d6e9828e4c3ed44cb7a67d2b9ed Mon Sep 17 00:00:00 2001
+From: Malte Sander <malte.sander.it@gmail.com>
+Date: Tue, 25 Nov 2025 11:30:24 +0100
 Subject: Include logging dependencies
 
-This adds dependencies required for use of the XmlLayout for logging
 ---
  standalone-metastore/pom.xml | 5 +++++
  1 file changed, 5 insertions(+)
 
 diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
-index c0bb928611..0f5de8ec3c 100644
+index 4f75c22dec..43c458d49e 100644
 --- a/standalone-metastore/pom.xml
 +++ b/standalone-metastore/pom.xml
-@@ -495,6 +495,11 @@
+@@ -582,6 +582,11 @@
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
      </dependency>

hive/stackable/patches/4.2.1/0003-Fix-CVE-2024-36114.patch

@@ -0,0 +1,26 @@
+From 96f3a4364b02f751e54328d88ad0edf3d639bba3 Mon Sep 17 00:00:00 2001
+From: Malte Sander <malte.sander.it@gmail.com>
+Date: Tue, 25 Nov 2025 11:31:34 +0100
+Subject: Fix CVE-2024-36114
+
+---
+ standalone-metastore/pom.xml | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
+index 43c458d49e..6517b3cc22 100644
+--- a/standalone-metastore/pom.xml
++++ b/standalone-metastore/pom.xml
+@@ -157,6 +157,12 @@
+         <version>${netty.version}</version>
+         <classifier>linux-x86_64</classifier>
+       </dependency>
++      <!-- Mitigate CVE-2024-36114: See https://github.com/stackabletech/vulnerabilities/issues/834 -->
++      <dependency>
++        <groupId>io.airlift</groupId>
++        <artifactId>aircompressor</artifactId>
++        <version>0.27</version>
++      </dependency>
+       <dependency>
+         <groupId>org.apache.orc</groupId>
+         <artifactId>orc-core</artifactId>

hive/stackable/patches/4.2.1/0004-Add-httpcomponents.core5-to-hive-standalone-metastor.patch

@@ -0,0 +1,40 @@
+From 780e2aaeae8d721e78f46a4312ce1dc38c436206 Mon Sep 17 00:00:00 2001
+From: Malte Sander <malte.sander.it@gmail.com>
+Date: Tue, 25 Nov 2025 14:44:35 +0100
+Subject: Add httpcomponents.core5 to hive-standalone-metastore
+
+Required for the REST Catalog.
+---
+ standalone-metastore/metastore-rest-catalog/pom.xml | 5 +++++
+ standalone-metastore/pom.xml                        | 2 ++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/standalone-metastore/metastore-rest-catalog/pom.xml b/standalone-metastore/metastore-rest-catalog/pom.xml
+index 5fb601fe1a..682259d334 100644
+--- a/standalone-metastore/metastore-rest-catalog/pom.xml
++++ b/standalone-metastore/metastore-rest-catalog/pom.xml
+@@ -26,6 +26,11 @@
+     <iceberg.version>1.9.1</iceberg.version>
+   </properties>
+   <dependencies>
++    <dependency>
++      <groupId>org.apache.httpcomponents.core5</groupId>
++      <artifactId>httpcore5</artifactId>
++      <version>${httpcomponents5.core.version}</version>
++    </dependency>
+     <dependency>
+       <groupId>org.apache.hive</groupId>
+       <artifactId>hive-standalone-metastore-server</artifactId>
+diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
+index 6517b3cc22..45d804e172 100644
+--- a/standalone-metastore/pom.xml
++++ b/standalone-metastore/pom.xml
+@@ -117,6 +117,8 @@
+     <slf4j.version>1.7.30</slf4j.version>
+     <httpcomponents.core.version>4.4.13</httpcomponents.core.version>
+     <httpcomponents.client.version>4.5.13</httpcomponents.client.version>
++    <!-- Required for REST Catalog. Should be in sync with Iceberg. -->
++    <httpcomponents5.core.version>5.3.1</httpcomponents5.core.version>
+     <pac4j-core.version>4.5.8</pac4j-core.version>
+     <nimbus-oauth.version>11.28</nimbus-oauth.version>
+     <jetty.version>9.4.57.v20241219</jetty.version>