[Snyk] Security upgrade org.apache.hadoop:hadoop-client from 3.3.6 to 3.4.3

[mahesh-thimmaiah]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Uncontrolled Recursion SNYK-JAVA-ORGAPACHECOMMONS-10734078	241	org.apache.hadoop:hadoop-client: 3.3.6 -> 3.4.3 Reachable No Known Exploit
	Uncontrolled Recursion SNYK-JAVA-COMNIMBUSDS-10691768	68	org.apache.hadoop:hadoop-client: 3.3.6 -> 3.4.3 No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[mahesh-thimmaiah]

This upgrade from Hadoop 3.3.6 to 3.4.3 is a minor version update but includes several significant breaking changes and dependency updates that require careful review.

Key Breaking Changes:

• Guava Dependency Upgrade: The core, non-relocated Guava dependency has been upgraded from version 27.0-jre to 32.0.1-jre. This is a major jump and carries a high risk of causing NoSuchMethodError or other runtime failures in downstream applications that also use Guava, due to API changes between versions.
• OpenStack Swift Connector Removed: The swift:// connector for OpenStack has been completely removed due to known issues. Any applications relying on this connector will fail.
• YARN Web API Relocated: The org.apache.hadoop.yarn.webapp.hamlet package has been removed. Code must be updated to use org.apache.hadoop.yarn.webapp.hamlet2 instead.
• Protobuf Dependency Removed: The protobuf-2.5.jar is no longer bundled with the distribution or included as a transient dependency. Projects that implicitly relied on Hadoop providing this library must now declare it as an explicit dependency.
• AWS S3A Checksum Behavior: Checksum calculation in the S3A connector has changed and may be incompatible with third-party object stores. You may need to set fs.s3a.md5.header.enabled or fs.s3a.checksum.calculation.enabled to restore previous behavior.

Recommendation: This upgrade requires significant verification. Developers must check for dependency conflicts, especially with Guava. Applications using the YARN web UI, OpenStack Swift, or S3-compatible stores need to be carefully tested and potentially updated.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.