Thrift upgrade 2 by InvisibleProgrammer · Pull Request #6893 · apache/hive

InvisibleProgrammer · 2026-10-18T20:42:16Z

Upgrade Apache Thrift 0.16.0 → 0.24.0 and, as a forced consequence, migrates the HTTP transport used by the JDBC driver, HiveServer2, and the Standalone Metastore from Apache HttpComponents 4.x (org.apache.http.) to 5.x (org.apache.hc.).

What changes were proposed in this pull request?

libthrift: 0.16.0 → 0.24.0
httpclient / httpcore (4.5.13 / 4.4.13) → httpclient5 / httpcore5 (5.6.2 / 5.4.3)
All Thrift-generated code (Java, C++, PHP, Python, Ruby) has been regenerated with the 0.23.0 compiler.
fb303.thrift has been vendored into the repository (upstream Apache Thrift no longer publishes libfb303).

Why are the changes needed?

CVE-2026-43869

Does this PR introduce any user-facing change?

No

How was this patch tested?

Existing tests. For significant code changes, new test cases added.

@@ -148,6 +165,11 @@
    this.httpAuthService = new HttpAuthService(cookieDomain, cookiePath, cookieMaxAge, isCookieSecure, AUTH_COOKIE);
  }

+  @Override
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+    doPost(req, resp);


@@ -269,7 +291,7 @@
        }
        LOG.info("Cookie added for clientUserName " + clientUserName);
      }
-      super.doPost(request, response);
+      processThriftRequest(request, response);


+      processor.process(inProtocolFactory.getProtocol(transport), outProtocolFactory.getProtocol(transport));
+      out.flush();
+    } catch (Exception e) {
+      throw new ServletException(e);


+  @Override
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+      throws ServletException, IOException {
+    doPost(req, resp);


saihemanth-cloudera · 2026-10-26T18:35:27Z

+          return ret;
        }
-        return (req instanceof HttpUriRequest && ((HttpUriRequest)req).isAborted());
+        return super.retryRequest(response, executionCount, context);


I think it would be better to avoid default response retries here. Retrying Thrift POSTs on 429/503 can execute queries or writes twice.

saihemanth-cloudera · 2026-10-26T18:44:24Z

+import org.apache.hc.core5.http.config.Registry;
+import org.apache.hc.core5.http.config.RegistryBuilder;
+import org.apache.hc.core5.ssl.SSLContexts;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
 import org.apache.thrift.transport.THttpClient;


nit: Can you remove unused imports in this file?

Removing the unused import with the next commit.

…ttpServices (apache#5907)" This reverts commit 4bdd0f1. (cherry picked from commit 98e88cf) (cherry picked from commit d3a573b95e35d494ce9814729fb08a6988c95f5d)

(cherry picked from commit 270b6e0) (cherry picked from commit b79c98c70421ca426831043b628d15a64e810f4b)

(cherry picked from commit b2cf5224b82b8142784188f9b3cf700e5cbce78f) # Conflicts: # .github/workflows/build.yml (cherry picked from commit 0a854fb)

sonarqubecloud · 2026-10-28T11:11:45Z

Quality Gate passed

Issues
44 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.5% Duplication on New Code

See analysis details on SonarQube Cloud

saihemanth-cloudera

LGTM +1. Will wait for extra set of eyes as this is a huge patch.

dengzhhu653 · 2026-10-29T10:00:12Z

I don't have a good understanding of the retry in HiveConnection, but the rest(thrift changes) sounds good.

InvisibleProgrammer · 2026-10-29T12:48:35Z

I don't have a good understanding of the retry in HiveConnection, but the rest(thrift changes) sounds good.

@dengzhhu653 : Thrift upgraded httpclient from 4 to 5. It is a breaking change.
Some parts of the original retry logic completely have been completely removed from httpclient so it was necessary to rewrite that to keep the original behavior.

dengzhhu653 · 2026-11-02T07:41:04Z

I don't have a good understanding of the retry in HiveConnection, but the rest(thrift changes) sounds good.

@dengzhhu653 : Thrift upgraded httpclient from 4 to 5. It is a breaking change. Some parts of the original retry logic completely have been completely removed from httpclient so it was necessary to rewrite that to keep the original behavior.

Sounds like HiveConnection(SAML) is the only place where has the incompatible issue, other old clients can still speak with HS2/HMS, right?

InvisibleProgrammer · 2026-11-02T14:58:10Z

I don't have a good understanding of the retry in HiveConnection, but the rest(thrift changes) sounds good.

@dengzhhu653 : Thrift upgraded httpclient from 4 to 5. It is a breaking change. Some parts of the original retry logic completely have been completely removed from httpclient so it was necessary to rewrite that to keep the original behavior.

Sounds like HiveConnection(SAML) is the only place where has the incompatible issue, other old clients can still speak with HS2/HMS, right?

Yes. We are testing it actively on downstream. Didn't have a failure so far.

asf-ci-hive added the tests pending label Oct 18, 2026

InvisibleProgrammer marked this pull request as draft October 18, 2026 20:42

asf-ci-hive added tests failed tests pending and removed tests pending tests failed labels Oct 18, 2026

github-advanced-security Bot found potential problems Oct 19, 2026

View reviewed changes

asf-ci-hive added tests unstable tests pending and removed tests pending tests unstable labels Oct 19, 2026

InvisibleProgrammer force-pushed the thrift_upgrade_2 branch from 5bb509a to 1687b2b Compare October 20, 2026 21:12

asf-ci-hive added tests failed tests pending tests passed and removed tests pending tests failed labels Oct 20, 2026

nrg4878 requested review from dengzhhu653, nrg4878 and saihemanth-cloudera October 22, 2026 20:13

saihemanth-cloudera reviewed Oct 26, 2026

View reviewed changes

asf-ci-hive added tests pending and removed tests passed labels Oct 27, 2026

InvisibleProgrammer added 2 commits October 27, 2026 17:15

Revert "HIVE-29047: Adjust httpclient5 httpcore dependencies in TestH…

cfecb77

…ttpServices (apache#5907)" This reverts commit 4bdd0f1. (cherry picked from commit 98e88cf) (cherry picked from commit d3a573b95e35d494ce9814729fb08a6988c95f5d)

In progress - upgrade httpclient

9b95744

(cherry picked from commit 270b6e0) (cherry picked from commit b79c98c70421ca426831043b628d15a64e810f4b)

kasakrisz and others added 3 commits October 27, 2026 17:15

build.yml - bump thrift

86440b2

(cherry picked from commit b2cf5224b82b8142784188f9b3cf700e5cbce78f) # Conflicts: # .github/workflows/build.yml (cherry picked from commit 0a854fb)

Fix rebase mistake to fix csrf test

8039c09

Address review comments

3e91655

InvisibleProgrammer force-pushed the thrift_upgrade_2 branch from 40e0429 to 3e91655 Compare October 27, 2026 16:16

asf-ci-hive added tests failed tests pending tests unstable and removed tests pending tests failed tests unstable labels Oct 27, 2026

asf-ci-hive added tests passed and removed tests pending labels Oct 28, 2026

saihemanth-cloudera approved these changes Oct 28, 2026

View reviewed changes

InvisibleProgrammer marked this pull request as ready for review October 28, 2026 18:05

dengzhhu653 approved these changes Nov 2, 2026

View reviewed changes

Merge branch 'master' into thrift_upgrade_2

047e9dc

asf-ci-hive added tests pending and removed tests passed labels Nov 2, 2026

dengzhhu653 merged commit 71c70f1 into apache:master Nov 2, 2026
5 of 6 checks passed

dengzhhu653 mentioned this pull request Nov 2, 2026

HIVE-30041: WiP: Thrift upgrade #6653

Closed

InvisibleProgrammer deleted the thrift_upgrade_2 branch November 11, 2026 09:56

slachiewicz approved these changes Nov 14, 2026

View reviewed changes

slachiewicz mentioned this pull request Nov 14, 2026

HIVE-30098: Vendor fb303.thrift so hive_metastore.thrift compiles without a separate fb303 install #6826

Closed

Navigation Menu

Repository navigation

Thrift upgrade 2 - #6893

Thrift upgrade 2#6893
dengzhhu653 merged 17 commits into
apache:masterfrom
InvisibleProgrammer:thrift_upgrade_2

InvisibleProgrammer commented Oct 18, 2026 •

edited

Loading

Uh oh!

saihemanth-cloudera Oct 26, 2026

Uh oh!

Uh oh!

saihemanth-cloudera Oct 26, 2026

Uh oh!

InvisibleProgrammer Oct 27, 2026

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 28, 2026

Uh oh!

saihemanth-cloudera left a comment

Uh oh!

dengzhhu653 commented Oct 29, 2026

Uh oh!

InvisibleProgrammer commented Oct 29, 2026 •

edited

Loading

Uh oh!

dengzhhu653 commented Nov 2, 2026

Uh oh!

InvisibleProgrammer commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

InvisibleProgrammer commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

Uh oh!

saihemanth-cloudera Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

saihemanth-cloudera Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

InvisibleProgrammer Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 28, 2026

Quality Gate passed

Uh oh!

saihemanth-cloudera left a comment

Choose a reason for hiding this comment

Uh oh!

dengzhhu653 commented Oct 29, 2026

Uh oh!

InvisibleProgrammer commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dengzhhu653 commented Nov 2, 2026

Uh oh!

InvisibleProgrammer commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

InvisibleProgrammer commented Oct 18, 2026 •

edited

Loading

InvisibleProgrammer commented Oct 29, 2026 •

edited

Loading